Question

Okay so I have a PHP script that makes a user an artist if vote is high enough. The first part of the script works (the part that does the voting). However, the second part of the script that makes a user an artist does not. It worked before on localhost but is not working on live server for some reason. Either the script has changed and I didn’t notice it or there’s something wrong with my server config.

I know I should be using mysqli but please don’t mention that I am working on it.

To explain how the system works, a form on the voting page is posted to this script and it all runs from there.

There is no error in the error log. Updating the table for //make an artist if vote high enough just doesn’t work.

Here’s the script:

<?php
session_start();
include("../database.php");
 $username = $_SESSION["username"];
$artistname = htmlspecialchars(mysql_real_escape_string($_POST['artistname']));
$trackname = htmlspecialchars(mysql_real_escape_string($_POST['trackname']));
$trackurl = htmlspecialchars(mysql_real_escape_string($_POST['trackurl']));

$flag = 0; // Safety net, if this gets to 1 at any point in the process, we don't upload.
if(isset($_POST['yes'])){

//code runs if vote is yes


//check if user hasnt already voted on track

 $result = mysql_query("SELECT username FROM voted WHERE voted='$artistname' AND trackname='$trackname' AND username='$username'")or die(mysql_error());
 $check2 = mysql_num_rows($result);

 if ($check2 != 0) {

    echo('<t1>Sorry, you have already voted on this track. <b>Click next track.</b>     </t1>');
   $flag = $flag + 1;
}

//code runs if everything is okay  
if($flag == 0){
mysql_query("UPDATE members SET vote = vote+1 WHERE artistname='$artistname'
");


echo '<t1><b>You liked the track "'.$trackname.'" by "'.$artistname.'"</t1></b>';



 mysql_query("INSERT INTO voted  (username, voted,trackname, yesno)

        VALUES ('".$username."','".$artistname."','".$trackname."', 'yes')")

or die(mysql_error()); 

//make an artist if vote high enough
$vote = mysql_query("SELECT vote FROM members WHERE artistname='$artistname'")or die(mysql_error());


 if ($vote > 50) {
 $artisturl = htmlspecialchars(mysql_real_escape_string(str_replace(' ', '',$_POST['artistname'])));

mysql_query("UPDATE members SET artist='Y', image1='../files/noprofile.jpg', artisturl='$artisturl' WHERE artistname='$artistname'
 ")or die(mysql_error());

 mysql_query("UPDATE tracks SET artist='Y', artisturl='$artisturl' WHERE artistname='$artistname'
")or die(mysql_error());

//email user that has just been made artist
$result = mysql_query("SELECT * FROM members WHERE artistname= '$artistname'");
while($row = mysql_fetch_array($result)){
function spamcheck($field)
{
//filter_var() sanitizes the e-mail
//address using FILTER_SANITIZE_EMAIL
 $field=filter_var($row['email'], FILTER_SANITIZE_EMAIL);

 //filter_var() validates the e-mail
 //address using FILTER_VALIDATE_EMAIL
  if(filter_var($row['email'], FILTER_VALIDATE_EMAIL))
   {
  return TRUE;
  }
  else
 {
  return FALSE;
 }
 }
 {//send email
 $to = $row['email'];
 $subject = "Congratulations! You're now an NBS artist";
 $message = "Hi ".$row['artistname'].",
 //message removed for condensed code
 $from = "";
 $headers = 'From:' . "\r\n" .
'Reply-To: ' . "\r\n";
mail($to,$subject,$message,$headers);   
 }
 }
 echo '<br><t1>You just made "'.$artistname.'" an artist! <a href="'.$artisturl.'"><b>Click here</b></a> to see their profile.</t1>';
 }
 }
 } 

Answer 1

You are missing two lines to convert the resource returned by mysql_query() into an integer for the comparison with 50.

$vote = mysql_query("SELECT vote FROM members WHERE artistname='$artistname'")or die(mysql_error());

// Add these two lines
$vote = mysql_fetch_assoc($vote);
$vote = $vote['vote'];

if ($vote > 50) {

…however, all that section could be re-written to use 2 queries instead of 4:

//make an artist if vote high enough
$artisturl = mysql_real_escape_string(htmlspecialchars(str_replace(' ', '',$_POST['artistname'])));

// This effectively combines the first SELECT and the two UPDATEs into one query
$result = mysql_query("
  UPDATE members m
  LEFT JOIN tracks t ON m.artistname = t.artistname
  SET
    m.artist = 'Y',
    t.artist = 'Y',
    m.image1 = '../files/noprofile.jpg',
    m.artisturl = '$artisturl',
    t.artisturl = '$artisturl'
  WHERE m.artistname = '$artistname' AND m.vote > 50
") or die(mysql_error());

// If this affected more than 0 rows, the user was made an artist
if (mysql_affected_rows($result) > 0) {

  //email user that has just been made artist
  $result = mysql_query("SELECT * FROM members WHERE artistname= '$artistname'");

  // ...and so on

Note also that you should pass data through mysql_real_escape_string() as the last operation. So it should go mysql_real_escape_string(htmlspecialchars($data)) rather than the other way around.