php - 需要在该文件中添加 count(*) 和 if 语句

Question

当我将 SELECT * 更改为 SELECT count(*) 时，脚本完全停止工作。如何向此文件添加 count(*) 和一条语句(如果 $user >= 20 的行数允许 INSERT，否则不执行任何操作)。

// Include needed files

include 'mysql.php';

// Connect to MySQL

connectMySQL();

//****** SECURITY CHECK *********

session_start();
if(isset($_SESSION['userid'])){
$user = mysql_real_escape_string($_SESSION['userid']); 

//*******************************

  // Retrieves variables through AJAX

$favid = mysql_real_escape_string($_GET['favid']);
// $favid = mysql_real_escape_string($_GET['favid']);

// Firstly, check if article is favourite or not

$query = mysql_query("SELECT * FROM ajaxfavourites WHERE user='$user' AND  favid='$favid'");
$matches = mysql_num_rows($query);

// If it is not favourited, add as favourite

if($matches == '0'){
mysql_query("INSERT INTO ajaxfavourites (user, favid, exptime) VALUES ('$user', '$favid', CURRENT_TIMESTAMP)");

echo "";
}


// Instead, if it is favourited, then remove from favourites

if($matches != '0'){
mysql_query("DELETE FROM ajaxfavourites WHERE user='$user' AND favid='$favid'");

echo "";
}

} else {

// Someone tries to directly access the file!

echo "Invalid session!";

}

谢谢!

Answer 1

请执行必要的步骤以避免 SQL 注入(inject)，并尝试使用 mysqli_* 函数而不是 mysql_* 函数

$query = mysql_query("SELECT COUNT(*) as cnt FROM ajaxfavourites WHERE user='$user' AND  favid='$favid'");
$res = mysql_fetch_array($query);

// If it is not favourited, add as favourite

if($res[cnt] == 0){
    mysql_query("INSERT INTO ajaxfavourites (user, favid, exptime) VALUES ('$user', '$favid', CURRENT_TIMESTAMP)");

    echo "";
}

// Instead, if it is favourited, then remove from favourites

if($res[cnt] > 0){
    mysql_query("DELETE FROM ajaxfavourites WHERE user='$user' AND favid='$favid'");

    echo "";
}