How to add points elsewhere?

[chadk]

What is the function called to add points?  I'd like to place point accumulators elsewhere on the site for other things like web links, giving karma, calendar events and whatever else I cank think of.

[Daniel15]

There's no function to add points, it's an SQL query. The query

Code: [Select]

UPDATE {$db_prefix}members SET money = money + 10 WHERE ID_MEMBER = {$ID_MEMBER}Will add 10 credits to the current member.

If you want to add credits to someone in a script, use something like:

Code: [Select]

$result = db_query("UPDATE {$db_prefix}members
                       SET money = money + 10
                       WHERE ID_MEMBER = {$ID_MEMBER}",
                    __FILE__, __LINE__);
In a SMF source file, where ever you want.

If you're making your own script, do something like:

Code: [Select]

<?php
require "SSI.php";

$result = db_query("UPDATE {$db_prefix}members
                       SET money = money + 10
                       WHERE ID_MEMBER = {$ID_MEMBER}",
                    __FILE__, __LINE__);
?>


[chadk]

Dan, I'm wondering why you use {$db_prefix} instead of .$db_prefix. like this:

Code: [Select]

      $sql = "INSERT INTO " . $db_prefix . "sbox_content (ID_MEMBER, content, time) VALUES ('" . $context['user']['id'] . "', '" . $content . "', '$date')";
      db_query($sql, __FILE__, __LINE__);
From the Shoutbox.  Should I be concerned with that type of code being vulnerable to sql injection?  He does slashes before he runs the sql but I'm not sure which method is proper?

[Daniel15]

Dan, I'm wondering why you use {$db_prefix} instead of .$db_prefix. like this:

It's the exact same thing... And since you're not taking any user input, it's not vulnerable to SQL injection. The code:

$result = db_query("UPDATE {$db_prefix}members
                       SET money = money + 10
                       WHERE ID_MEMBER = {$ID_MEMBER}",
                    __FILE__, __LINE__);


Is equivelant to:

$result = db_query("UPDATE ".$db_prefix."members
                       SET money = money + 10
                       WHERE ID_MEMBER = ".$ID_MEMBER,
                    __FILE__, __LINE__);