Discover Habbo's history
Treat yourself with a Secret Santa gift.... of a random Wiki page for you to start exploring Habbo's history!
Happy holidays!
Celebrate with us at Habbox on the hotel, on our Forum and right here!
Join Habbox!
One of us! One of us! Click here to see the roles you could take as part of the Habbox community!


Results 1 to 6 of 6
  1. #1
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default Is this correct syntax?

    I know it's bad practice to use tables for users, but ah well, here it is this is to delete a user.

    PHP Code:
    <?php

    $user 
    $_GET['user'];
    $sql_a mysql_query("DROP" .$user"table IF EXISTS");
    $sql_b mysql_query("DELETE * FROM users WHERE user='$user'");

    if(
    $sql_a) {
        if(
    $sql_b {
        echo 
    "" .$user"successfully deleted!";
        }
    }
    ?>
    How could this hapen to meeeeeeeeeeeeeee?lol.

  2. #2
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default

    edit change.
    How could this hapen to meeeeeeeeeeeeeee?lol.

  3. #3
    Join Date
    Oct 2006
    Location
    Peterborough, UK
    Posts
    3,855
    Tokens
    216

    Latest Awards:

    Default

    PHP Code:
    <?php
    if( mysql_query"DELETE FROM `users` WHERE lcase( `user` ) = lcase( '" htmlentities$userENT_QUOTES ) . "' )" ) )
    {
        echo( 
    "Jews in the oven." );
    }
    ?>


    visit my internet web site on the internet
    http://dong.engineer/
    it is just videos by bill wurtz videos you have been warned

  4. #4
    Join Date
    Jan 2007
    Location
    Canada eh?
    Posts
    766
    Tokens
    75

    Default

    PHP Code:
    <?php
    $user 
    $_GET['user'];
    $sql_a mysql_query("DROP `".$user."table` IF EXISTS");
    $sql_b mysql_query("DELETE * FROM `users `WHERE `user` = '".$user."'");
    if(
    $sql_a&&$sql_b){
        echo 
    $user" successfully deleted!";
    }
    ?>
    OR (like dan did)

    PHP Code:
    <?php
    $user 
    $_GET['user'];
    if(
    mysql_query("DROP `".$user."table` IF EXISTS")&&mysql_query("DELETE * FROM `users `WHERE `user` = '".$user."'")){
        echo 
    $user" successfully deleted!";
    }
    ?>
    My only other suggestion would be to make sure that you run some sort of cleaning function on $_GET['user'] before you use it directly in a MySQL query. If not it could lead to major security vulnerabilities.

  5. #5
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default

    I already reverted to better coding, not using tables, as it is mainly a waste, and confusing for searches etc.
    How could this hapen to meeeeeeeeeeeeeee?lol.

  6. #6
    Join Date
    Jan 2007
    Location
    Canada eh?
    Posts
    766
    Tokens
    75

    Default

    Quote Originally Posted by Reconix View Post
    I already reverted to better coding, not using tables, as it is mainly a waste, and confusing for searches etc.
    Well using tables is fine, just not if you have a seperate table for every user.... that becomes a bit ridiculous. Generally what you do is make one 'user' table with certains fields and then every new user is a new row in the table. That way it is much easier to edit fieldnames, keep track of total users and etc.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •