0
<?php
$username = "...";
$password = "...";
$database = "...";



switch($_POST['function'])
{
    case 'register':
        $db_handle = new mysqli('localhost',$username,$password,$database);
        $sql = "SELECT * FROM `GameSaves` WHERE `Username` = '$un' and `Password` = '$pw'";

        if (!$db_handle->connect_error)
        {
            $r = $db_handle->query($sql);
            $count= $r->num_rows;

            $un = $_POST['username'];
            $pw = $_POST['password'];
            $data = '0';

            if ($count == 1)
                echo "fail";
            else
            {
                $sql = "INSERT INTO `GameSaves` (Username,Password,SaveData) VALUES ('test1','test2','0')";
                $res = $dbl_handle->query($sql);
                echo "succes";
            }
        }
        mysqli_close($db_handle);
    break;

    case 'login':
        $un = $_POST['username'];
        $pw = $_POST['password'];

        $db_handle = new mysqli('localhost',$username,$password,$database);
        $sql = "SELECT * FROM `GameSaves` WHERE `Username` = '$un' and `Password` = '$pw'";

        if (!$db_handle->connect_error)
        {
            $r = $db_handle->query($sql);
            $count= $r->num_rows;

            if ($count == 1)
                echo "succes";
            else
                echo "fail";
        }
        mysqli_close($db_handle);
    break;

    case 'getdata':
        $un = $_POST['username'];
        $sql = "SELECT * FROM `GameSaves` WHERE `Username` = '$un'";
        $db_handle = new mysqli('localhost',$username,$password,$database);

        if (!$db_handle -> connect_error)
        {
            $retval = $db_handle->query($sql);

            while ($row = $retval->fetch_assoc())
            {
                echo "{$row['SaveData']}";
            }
            mysqli_close($db_handle);
        }
    break;

    case 'savedata':
        $un = $_POST['username'];
        $db_handle = new mysqli('localhost',$username,$password,$database);

        if (!$db_handle -> connect_error)
        {   
            $data = $_POST['data'];
            $retval = $db_handle->query("UPDATE `GameSaves` SET `SaveData` = '$data' WHERE `Username` = '$un'");
            mysqli_close($db_handle);
        }
    break;
}
?>

This is my class.

I get the error: call to a member function query() on a non-object on line 28. I am clueless what to change on the $sql at register case. I looked everywhere on the internet but I can't find a solution to my problem.

Sculper
  • 756
  • 2
  • 12
  • 24
Lars Spaenij
  • 11
  • 1
    1) It looks like you're trying to use values like `$un` and `$pw` *before they actually exist*. 2) You're using those values in a very SQL-injectable way. Bind values to parameters on prepared statements, don't put the values directly into the query code. 3) You're storing user passwords in plain text. ***Never store user passwords in plain text.*** It's *grossly irresponsible* to your users. Passwords should be stored as a 1-way hash and *never be readable* by anybody, not even you as the system administrator. – David Jun 25 '15 at 17:54
  • I tried to remove them at register and tried to hardcode the values but didn't work. And I am just a student trying this for the first time. – Lars Spaenij Jun 25 '15 at 17:57
  • 1
    Add error reporting to the top of your file(s) right after your opening PHP tag for example ` – Funk Forty Niner Jun 25 '15 at 17:58
  • ^ This is one of "God's" favorite tools ^ – Funk Forty Niner Jun 25 '15 at 18:02

2 Answers2

1

There is a typo in your code.

change

$dbl_handle->query($sql);

to

$db_handle->query($sql);
pinkal vansia
  • 10,240
  • 5
  • 49
  • 62
0

It's a problem with

 $db_handle = new mysqli('localhost',$username,$password,$database);

You don't receive mysqli object, so you are not allowed to use mysqli::query() method.

Change

if (!$db_handle->connect_error)

to

if (!$db_handle->connect_errno)

Cause probably you don't properly handle connection errors with "connect_error".

Are you sure that variables

$username,$password,$database

Have proper access data?

pavon147
  • 703
  • 1
  • 8
  • 15