Displaying information comming on web database to another scene

News & General Discussion
1

Guys, is there any problem with my php code? becasue i want to display the output on the next scene from the logged in information comming form the web database. ive used playerprefs to store temporary data and later on call it to compare on one of the php scripts ive created. Ive tried to output one of the data stored on the web databse which is “levels” but i have no luck in doing it, and only the username is displaying in the interface. i think one of my problem is to communicate with php or sql syntax. here is my sample php code! any idea will do tnx

PlayerDetails.php

<?php
	$host = "localhost";
	$user = "root";
	$password = "sukahinaku";
	$dbname = "typeshooter";
	
	$con = mysql_connect($host, $user, $password) or die ("Cant connect into database");
	mysql_select_db($dbname) or die ("Cant connect to Database");
	
	$unityHash = $_POST["hash"];
	$phpHash = "hashcode"; 
	$username = $_POST["playerName"];
	$level = $_POST["level"];
	$coins = $_POST["coins"];

	
	if(!$username){
		echo "Username or password cant be empty.";
	} 
	else{
		if ($unityHash != $phpHash){
			echo "HASH code is diferent from your game, you infidel.";
		} else {
			$SQL = "SELECT * FROM useraccount WHERE username = '".$username."'";
			$result_id = @mysql_query($SQL) or die("DATABASE ERROR!");
			$total = mysql_num_rows($result_id);
			if($total) {
				$datas = @mysql_fetch_array($result_id);
			
				if(!strcmp($username, $datas["username"])) {
					echo "Username: ".$username;
				} 
				else {
					echo "Nick or password is wrong.";
				}
			}
			else {
            echo "Data invalid - cant find name ".$username;
			}

		}

	}

?>
2

I highly recommend you do some reading on security practices… you’re leaving yourself open to SQL injection attacks by not escaping the data before you build your query statement.

http://www.php.net/manual/en/function.mysql-real-escape-string.php

Also… you’re only accepting a username and then using a query to get it from the database… you’re leaving yourself open to spoofing by allowing someone to just send another username to your endpoint… you should be comparing password or some kind of hashed auth token as well.

Additionally… since the user should only exist once in the database, you should use a LIMIT 1 to get the record… or do a:

SELECT COUNT(userid) FROM useraccount WHERE username…

Then just check to see if the count is > 0. There’s no need to return data from the database since you’re just checking to see if the record exists.