检查用户是否在数据库中

Question

I have developed a game with Javascript and when the user finishes it, I must save his record in a database. Here you see the code:

$temp = $_POST['playername'];             //username
$text  = file_get_contents('names.txt');  //list with all usernames

//this text file contains the names of the players that sent a record.

$con=mysqli_connect("localhost","username","pass","my_mk7vrlist");

if (stripos(strtolower($text), strtolower($temp)) !== false) {
//if the username is in the list, don't create a new record but edit the correct one   

 mysqli_query($con, "UPDATE `my_mk7vrlist`.`mk7game` SET `record` = '".$_POST['dadate']."' WHERE `mk7game`.`playername` = ".$temp." LIMIT 1 ");

} else {

 //The username is not in the list, so this is a new user --> add him in the database
 mysqli_query($con, "INSERT INTO `mk7game` (`playername`,`record`,`country`,`timen`) VALUES ('".$_POST['playername']."', '".$_POST['dadate']."', '".$_POST['country']."', '".$_POST['time_e']."')");

 file_put_contents("names.txt",$text."
".$temp);
 //update the list with this new name
}

//Close connection
mysqli_close($con);

When I have a new user (the part inside my "else") the code works correctly because I have a new row in my database.

When the username already exists in the list, it means that this player has already sent his record and so I must update the table. By the way I cannot edit the record on the player that has alredy sent the record.

mysqli_query($con, "UPDATE `my_mk7vrlist`.`mk7game` SET `record` = '".$_POST['dadate']."' WHERE `mk7game`.`playername` = ".$temp." LIMIT 1 ");

It looks like this is wrong, and I can't get why. I am pretty new with PHP and MySQL.

Do you have any suggestion?

Answer 1

You're missing quotes around $temp in the UPDATE statement:

mysqli_query($con, "UPDATE `my_mk7vrlist`.`mk7game` 
                    SET `record` = '".$_POST['dadate']."' 
                    WHERE `mk7game`.`playername` = '".$temp."' 
                                                   ^         ^
                    LIMIT 1 ") or die(mysqli_error($con));

However, it would be better to make use of prepared statements with parameters, rather than inserting strings into the query.