
Originally Posted by
Mambo
Somethign like:
<?php
$Host="YOURNAME\SQLEXPRESS";
$Name="sa";
$Pass="YOURPASS";
$Db="GunzDB";
MSSQL_Connect ("$Host,$Name,$Pass");
MSSQL_Select_db ("GunzDB")
?>
<?php
FORM HERE.. i didn't work with html for long time so idk
?>
<?php
INSERT IN CharItem ("ITEMID") WHERE Charname = ['$_Post']
?>
This is a part/start of a script :P someone with more knowlegde can finish this.. btw don't flame me if it sux cause it's my first thing ever :P
Roflmao. INSERT IN... LOL.
This comes straight out of my head, it's weekend and 10:35 PM so I might make a few typing mistakes:
PHP Code:
<?php
//Made by Wizkid.
//Removing my copyright is stupid.
//Let us connect the database.
$host = "";
$username = "";
$password = "";
$database = "GunzDB";
mssql_connect($host, $username, $password) or die("Can't connect the db server.");
mssql_select_db($database) or die("Can't select the database.");
//Anti SQL injection
function antisql($sql)
{
// Remove words that contain SQL syntax
$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
$sql = trim($sql); //Cleans up spaces
$sql = strip_tags($sql);//Php and html tags strip
$sql = addslashes($sql);//Adds backslashes to one string
return $sql;
}
//GET the act and do the stuff.
if (isset($_GET['act']) AND $_GET['act'] == "do")
{
//Let's get the charname.
$charname = antisql($_POST['charname']);
//No charname entered... the bastard.
if (empty($charname))
{
die("No shit.");
}
//Let us get the CID.
$query = mssql_query("SELECT CID FROM Character WHERE Name = '$charname'");
$count = mssql_num_rows($query);
//Charname doesn't exist into the table or does exist multiple times.
if ($count != 0)
{
die("Shit happened or you can't type.");
}
$res = mssql_fetch_assoc($query);
//The real part. Edit the ItemID eventually.
mssql_query("INSERT INTO CharacterItem (CID, ItemID) VALUES ('$res[CID]', '50042')");
}
?>
<form action='<?=$_SERVER['PHP_SELF']?>?act=do' method='POST'>
Text shit goes here.<br><br>
<table width='250'>
<tr>
<td width='50%'><b>Charactername:</b></td>
<td width='50%'><input type='text' name='charname'></td>
</tr>
<tr>
<td width='50%'></td>
<td width='50%'><input type='submit' value='Welcome!'></td>
</tr>
</table>
</form>
<br><br>
<font size='1'>Made by Wizkid.</font>