Question

Okay so the title may be a bit misleading. What I am trying to do is add a favorite system to my site. I have one column for my favorite things and I set it up so after each item ID there is a :. How can I check the string returned from my database (1345:13456:232:524378:324) if it contains 232? If it does I would echo preRend else I would echo insert and insert that ID followed by a :. This is what I have so far:

<?php
session_start();
require_once(".conf.php");
$logged = $_SESSION['logged'];
$user = $_SESSION['user'];
$fwdfav = $_POST['id'];
$query = mysql_query("SELECT * FROM accountController WHERE user='$user'");

if ($logged == 1) 
{
    while ($row = mysql_fetch_array($query)) {
    if ($row['fav-itms'] //This is where I got stuck. How to check if it contains a value.)
        {
            mysql_query("INSERT INTO accountController ('fav-itms') VALUES ('$fwdfav')");
            echo 'inserted';
        }
        else
        {
            echo 'preRend';
        }

    }
} 
else
{
    echo 'nlog';
}
?>

Thank you so much! I am sure there are a lot of errors here as I am very tired.

Answer 1

The approach you are taking is extremely inefficient and does not take advantage of the fact that you are using a database.

(Btw… I hope this is just example code; you have a giant SQL injection vulnerability in your INSERT query.)

What I would do instead is create a second table that would look something like:

favorites (
    id int(11) NOT NULL auto_increment,
    user_id int(11),
    fav_id int(11)
)

And have each row represent a user-favorite pair. Then you can let MySQL do the heavy lifting of figuring out whether a user has favorited something, e.g.,

SELECT COUNT(*) FROM favorites WHERE user_id = %d AND fav_id = %d;
// Substitute the actual look-up values in using prepared statements

You could also similarly quickly get the actual favorites for a user, etc.

Remember, a database is designed for the explicit purpose of storing and looking up information quickly. PHP is a general-purpose programming language. Where possible, let MySQL do the walking for you.

(This advice is general for a moderately scaled setup. If you need to handle millions of simultaneous users, far more optimization is obviously required, and conventional relational databases might not even be suitable. But I don’t get the impression that’s where you’re at right now.)