0

I am trying to add a "like" function to my social network, however my code does not work and wont print any errors.
The functions uses $_GET to find out if a comment or a post should be "liked" and procedes to check if the user has already liked the post or comment. If so, the function will "unlike".

Can anyone help me figure out what I've done wrong?

Code:

<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
session_start();
include "./db-connect.php";
$memberID= $_SESSION['memberID'];

if(isset($_GET['post_id'])){
$postID=$_GET['post_id'];
$sqlCheck="SELECT * from cs_likes WHERE post_id = $postID AND member_id = $memberID";
$sqlInsert="INSERT INTO cs_likes (post_id, member_id) VALUES ('$postID','$memberID')";
$sqlDelete="DELETE FROM cs_likes WHERE post_id= $postID AND member_id = $memberID";
}
elseif(isset($_GET['comment_id'])){
$commentID=$_GET['comment_id'];
$sqlCheck="SELECT * from cs_likes WHERE comment_id = $commentID AND member_id = $memberID";
$sqlInsert="INSERT INTO cs_likes (comment_id, member_id) VALUES ('$postID','$memberID')";
$sqlDelete="DELETE FROM cs_likes WHERE comment_id= $commentID AND member_id = $memberID";
}
$checkResult=mysqli_query($link, $sqlCheck);
if(mysqli_num_rows($checkResult)=0)
$result=mysqli_query($link,$sqlInsert);
else
$result=mysqli_query($link,$sqlDelete);



?>
Thomas Skjørberg
  • 3
  • 1
  • 1
    "my code does not work" - ok, and how do you know that your code does not work? and i hope this is a private social network on a LAN - otherwise your server will be compromised soon: http://stackoverflow.com/q/332365/3391783 – low_rents Apr 30 '16 at 19:33
  • It is, and I know I have not used mysqli_real_escape_string, I will when it Works. I know it does not work because the databse is still empty and the page reads a 500-error – Thomas Skjørberg Apr 30 '16 at 19:37
  • 1
    using an escaping function doesn't help you against SQL injection - you totally HAVE TO use parameters: https://phpdelusions.net/sql_injection – low_rents Apr 30 '16 at 19:40

1 Answers1

1

Your code...

if(mysqli_num_rows($checkResult)=0)

Should be a double equal...

if(mysqli_num_rows($checkResult)==0)
ThrowBackDewd
  • 1,737
  • 2
  • 13
  • 16