Question

I have some troubles to find the right loop to check if some values are contained in mysql DB.

I’m making a software and i want add license ID. Each User has x keys to use.

Now when the user start the client , it invokes a php page that check if the Key sent in the POST method is stored in DB or not.

If that key isnt store than i need to check the number of his keys. If it’s > than X i’ll ban him otherwise i add the new keys in the DB.

I’m new with PHP and MYSQL. I wrote this code and i would know if i can improve it.

<!-- language: php -->


                ....
                $user = POST METHOD 
                $licenseID = POST METHOD
                ....
                ....
                $resultLic= mysql_query("SELECT  id , idUser , idLicense FROM license WHERE idUser = '$user'") or die(mysql_error());
                $resultNumber = mysql_num_rows($resultLic);
                $keyFound = '0'; // If keyfound is 1 the key is stored in DB
                    while ($rows = mysql_fetch_array($resultLic,MYSQL_BOTH)) {
                           //this loop check if the $licenseID is stored in DB or not
                            for($i=0; $i< $resultNumber ; i++)
                                               { 
                                         if($rows['idLicense'] === $licenseID) {
                                         //Just for the debug 
                                              echo("License Found");
                                              $keyFound = '1';
                                               break;
                                               }
                  //If key isn't in DB and there are less than 3 keys the new key will be store in DB
                                     if($keyfound == '0' && $resultNumber < 3){
                                         mysql_query(Update users set ...Store $licenseID in Table) }
          // Else mean that the user want user another generated key (from the client) in the DB and i will be ban 
(It's wrote in TOS terms that they cant use the software on more than 3 different station)                    
                 else    {   mysql_query(update users set ban ='1'.....etc)
                                  }                               
                    }

I know that this code seems really bad so i would know how i can improve it. Someone Could give me any advice?

Update: I forgot to say that i choose to have 2 tables one users where is content all information about the users id , username , password etc and another table license where i get id , idUsername , idLicense (the last one store license that the software generate)

Thanks

Answer 1

I might be wrong, but why not issuing the search for the LicencsId to Mysql with this SQL query

"SELECT id , idUser , idLicense FROM license WHERE idUser = '$user' AND idLicense='$licenseID'

---

for security reasons escape the input
"SELECT id , idUser , idLicense FROM license WHERE idUser = " . mysql_real_escape_string($user) . " AND idLicense=" . mysql_real_escape_string($licenseID)