I'm trying to insert using a string that is created in a separate function but it does not appear to be working.
I know I should be using a switch statement or something for this but it is purely for testing at the moment.
<?php
function newItem($link){
$itemname = mysqli_real_escape_string($link, $_POST['itemname']);
if (strpos($itemname,'<') || strpos($itemname,'>') || strpos($itemname,'?') || strpos($itemname,'/') || strpos($itemname,'='))
{
echo "<script type='text/javascript'>alert('yeah....no');</script>";
} else {
$sql = "SELECT * FROM items WHERE itemname = '$itemname'";
$result = mysqli_query($link,$sql);
if(mysqli_num_rows($result) !== 1){
$sql = "INSERT INTO items(itemname,itemtype,attack,defence,energy)VALUES('$itemname'".RandomStats($link).")";
mysqli_query($link,$sql);
header("location: index.php");
}else{
echo "<script type='text/javascript'>alert('Item name already exists');</script>";
}
}
}
function RandomStats($link){
$rand = rand ( 1 , 100 );
$itemtype = rand (1,3);
$itemtypeString;
if($itemtype = 1){
$itemtypeString = 'Armour';
}
if($itemtype = 2){
$itemtypeString = 'Sword';
}
if($itemtype = 3){
$itemtypeString = 'Shield';
}
if($rand <= 50){
//common
$attack = rand (1 , 50);
$defence = rand (1 , 50);
$energy = rand (1 , 50);
$ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
}
if ($rand >50 and $rand <= 80){
//rare
$attack = rand (1 , 100);
$defence = rand (1 , 100);
$energy = rand (1 , 100);
$ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
}
if ($rand >80 and $rand <= 98){
//exotic
$attack = rand (1 , 150);
$defence = rand (1 , 150);
$energy = rand (1 , 150);
$ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
}
if ($rand >98 and $rand <= 100){
//ledgendary
$attack = rand (1 , 200);
$defence = rand (1 , 200);
$energy = rand (1 , 200);
$ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
}
return $ItemStats;
}
?>
is it just that the way I'm creating the string I'm making the statement incorrect or is it something else?