Send variable from C# to php for MySQL (Unity)

Question

i'm new to MySQL system. I have to store in a database:

Username; Score; Resources.

For send username, score and resources i don't have any problems but whene i try to get resources from database i have this error:

</style>
</head>

<body>
<h1>Bad request!</h1>
<p>


Your browser (or proxy) sent a request that
this server could not understand.

</p>
<p>
If you think this is a server error, please contact
the <a href="mailto:postmaster@localhost">webmaster</a>.

</p>

<h2>Error 400</h2>
<address>
<a href="/">localhost</a><br />
<span>Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1</span>
</address>
</body>
</html>


UnityEngine.Debug:Log(Object)
<SetPlayerName>c__Iterator1:MoveNext() (at       Assets/Scripts/DataBase/MySQL/DBLoader.cs:67)
UnityEngine.SetupCoroutine:InvokeMoveNext(IEnumerator, IntPtr)

This is my php file:

<?php

    $servername = "host";
    $username    = "name";
    $password    = "";
    $dbname        = "game_name";

    $coinsname     = (isset($_REQUEST['coinsnameGet']) ? $_REQUEST['coinsnameGet'] : null);

    //Create Connection
    $connection = new mysqli($servername, $username, $password, $dbname);

    //Check Connection
    if(!$connection) {
        die("Connection Failed. " . mysqli_connect_error());
    }

    $sql = "SELECT Coins FROM score WHERE Name = '" . $coinsname . "'";
    $result = mysqli_query($connection, $sql);

    while($row = mysqli_fetch_array($result, MYSQLI_BOTH) {
        echo $row['Coins'];
    }
?>

I have to check if name is == to local database name then get resources. The local db is made with sqlite.

And this is my connected class:

private DataBase dbLocal;

    WWW userData;
    WWW scoreData;
    WWW coinsData;

    public Text Coins;

    private string[] dbUsers;
    private string[] dbScores;

    private string dbCoins;

    private string postCoinsData = "http://host/game_name/UsercoinsData.php";

    public GameObject scorePrefab;
    public Transform scoreParent;

    public GameObject rankValue;
    public GameObject nameValue;
    public GameObject scoreValue;

    // Use this for initialization
    IEnumerator Start () {

        dbLocal = (DataBase)FindObjectOfType(typeof(DataBase));

        userData = new WWW("http://host/game_name/UsernameData.php");
        scoreData = new WWW("http://host/game_name/UserscoreData.php");

        yield return userData;
        yield return scoreData;

        string textUserData = userData.text;
        dbUsers = textUserData.Split(';');

        string textScoreData = scoreData.text;
        dbScores = textScoreData.Split(';');

        scoreParent.transform.localPosition = new Vector3(0, 0, 0);

        dbLocal.Connection();

        StartCoroutine(SetPlayerName());
        GenerateScore();
    }

    IEnumerator SetPlayerName()
    {
        string setName = postCoinsData + "coinsnameGet = " + WWW.EscapeURL(dbLocal.GetName());
        WWW dataCoins = new WWW(setName);

        Debug.Log(dbLocal.GetName());

        yield return dataCoins;

        string textDataCoins = dataCoins.text;
        Coins.text = textDataCoins;
        Debug.Log(Coins.text); //This log the error
    }

If i change this:

$sql = "SELECT Coins FROM score WHERE Name = '" . $coinsname . "'";

with this:

$sql = "SELECT Coins FROM score WHERE Name = 'PlayerName'";

In brower i see the score.

Thx in advance!

You are wide open to SQL Injections and should really use Prepared Statements instead of concatenating your queries. Specially since you're not escaping the user inputs at all! It's not just a security concern, but if the input contains, for example, a '-character or a backslash, your query will fail. — M. Eriksson
– M. Eriksson, Commented Mar 2, 2017 at 15:04

Fredrik · Accepted Answer · 2017-03-02 15:01:47Z

1

Your php will never find the $_REQUEST['coinsnameGet'] because you're creating the URL like this:

string setName = postCoinsData + "coinsnameGet = " + WWW.EscapeURL(dbLocal.GetName());

which will look something like:

http://host/game_name/UsercoinsData.phpcoinsnameGet = PlayerName

but should look like

http://host/game_name/UsercoinsData.php?coinsnameGet=PlayerName

Not entirely sure if this is what's causing your issues or if it's a copy-paste error, but if it is, your code should be changed to:

string setName = postCoinsData + "?coinsnameGet=" + WWW.EscapeURL(dbLocal.GetName());

answered Mar 2, 2017 at 15:01

Fredrik

5,0971 gold badge24 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Send variable from C# to php for MySQL (Unity)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related