So basically, I have a rankings script, it works good. I'm making it only show characters from account thats logged in. That means WHERE accounts.id=$userid, I got that part covered.
My problem is how should mysqli query look? I tried puting WHERE accounts.id=".$userid." and I'm getting non-object errors which I think mean that my $sql is messed up.
You can ignore missing top part of table and $jobs variable, its not relevant.
<?php
if (isset($_GET['start'])) {
if ($_GET['start'] >= 0 && $_GET['start'] <= 1000) {
$start = sql_injectionproof($_GET['start']);
} else {
die("Input not allowed.");
}
} else {
$start = 0;
}
$mysqli = new mysqli("XXXXXX", "XXXXX", "XXXXXXXX", "XXXXXXX");
$i = $start;
$sql = $mysqli->query("SELECT characters.name , characters.job, characters.level, characters.experience, characters.fame, accounts.isloggedin FROM characters, accounts WHERE accounts.username=".$username." and characters.accountid=accounts.id and characters.ismaster = 0 and accounts.isbanned = 0 ORDER BY characters.level DESC, characters.experience DESC LIMIT ".sql_injectionproof($start).", 500");
while ($outcome = $sql->fetch_array()) { ?>
<tr>
<td class="center" style="vertical-align: middle;">#<?php echo"".++$i.""; ?></td>
<td class="center" style="vertical-align: middle;"><img src="images/char/create.php?name=<?php echo "".$outcome['name'].""; ?>" alt="<?php echo $outcome['name']; ?>"></td>
<td class="center" style="vertical-align: middle;"><?php echo "".$outcome['name'].""; ?></td>
<td class="center" style="vertical-align: middle;"><?php echo "".$outcome['level'].""; ?></td>
<td class="center" style="vertical-align: middle;"><?php echo "".$jobs[$outcome['job']].""; ?></td>
</tr>
<?php
}
if ($start >= 0 && $start <= 1000) {
$nextstart = $start + 10;
if ($start >= 2) {
$prevstart = $start - 10;
} else {
$prevstart = 0;
}
} else if ($start > 180 && $start <= 1000) {
$prevstart = $start - 2;
$nextstart = 1000;
} else {
die("Hacks.");
}
?>
You're missing quotes around your string value:
WHERE accounts.username=".$username." and
should be:
WHERE accounts.username='".$username."' and
Also, $username does not appear to be defined which will cause your query to return no results.