[Procedure] & [Help] TGetUserID by glossy

02/17/2013 03:19 glossypvp#1

Hi,

When I was trying to create an itemshop for our 4story server, I needed to create a function which returns the userID if we know the username (szUserID).

Code:

ALTER PROCEDURE [dbo].[TGetUserID2]
@szUserID varchar(50)
AS
BEGIN
DECLARE @szRes varchar(50)
SET @szRes= (Select dwUserID FROM TGLOBAL_GSP.dbo.TACCOUNT where szUserID=@szUserID);
print @szRes
END

Code:

@szRes

will be the returned userID.

I need a little help, I would like to put this into PHP. I've tried two ways with no luck.
My code:.

PHP Code:


			
$_POST['Username'];

stores the username as we know

PHP Code:


			
<?php
require_once("config.php");
$connect = odbc_connect('Driver={SQL Server};Server='.$host.';', $user, $pass);
$sql = "Select dwUserID FROM TGLOBAL_GSP.dbo.TACCOUNT where szUserID='".$_POST['Username']."";
$r = odbc_exec($connect,$sql);
print $r
?>

But usually it returns 0, or that:

Code:

Deprecated: Assigning the return value of new by reference is deprecated in C:\xampp\php\PEAR\Config.php on line 80

Deprecated: Assigning the return value of new by reference is deprecated in C:\xampp\php\PEAR\Config.php on line 166

Deprecated: Assigning the return value of new by reference is deprecated in C:\xampp\php\PEAR\Config\Container.php on line 111
Resource id #9
Logout

.

Can I get some help?
By the way use my code & procedure as you want, it's free;)

02/17/2013 08:33 acooarioom#2

First of all you need some SQL injection measures. And then, you need to prepare the statement/connection. You do need to connect, and of course, close the connection. You could place all that inside a function, it would be easier for you to use it, and you can use it on other pages as well.

The function:

PHP Code:


			
<?php
function userid($username) {
    require_once("config.php");
    if (!ctype_alnum($username)) {
        return 0;
    }
    $connect = odbc_connect('Driver={SQL Server};Server=$host;', $user, $pass);
    if (!$connect) {
        return 0;
    }
    $sql = "SELECT dwUserID FROM TGLOBAL_GSP.dbo.TACCOUNT WHERE szUserID=$username";
    $prepared = odbc_prepare($connect,$sql);
    $r = odbc_exec($prepared);
    odbc_close($connection);
    return $r;
}
?>

The page:

PHP Code:


			
<?php
include("functions.php");
$userid = userid($_POST['Username']);
if (!$userid) {
    // Error:
    // DB Error or SQL Injection Attempt
} else {
    // Success:
    // Your normal page's code
}
?>

I think this would work, Im not 999% sure though.

02/17/2013 08:42 stotterer09#3

I have a vb.net code which this you can get the userid if you like to have the code pm me

02/23/2013 10:59 glossypvp#4

I've tried it, it's not working :S

Edit:
Finally I've done it!
PM me if you need the code.