Enviado em 14/12/2021 - 05:19h
Olá, alguém poderia avaliar meu código, digo, com relação aseguraça se tá tudo ok?
<?php
$maxScore = 100;
$maxSavedScore = 100000;
$hostname = "HOST";
$username = "USER";
$password = "SENHA AQUI";
$database = "NOME DB";
$conn = mysqli_connect($hostname, $username, $password, $database);
if ($conn->connect_error) {
die("Falha na conexão com o banco");
}
//verifica se é novo score
$player = mysqli_real_escape_string($conn, $_POST["player"]);
$points = mysqli_real_escape_string($conn, $_POST["points"]);
$query = "select player, points from highscores where player=\"$player\" and points=$points";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) != 0) {
//echo "Não é novo score\n";
return;
}
$query = "select count(id) from highscores";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) >= $maxSavedScore) {
$query = "delete from highscores where (select min(points) from highscores)";
$result = mysqli_query($conn, $query);
}
$query = "insert into highscores (player, points) values (\"$player\", $points)";
$result = mysqli_query($conn, $query);
mysqli_close($conn);
?>