not sure how to describe issue

hey guys,

excuse me as I’m fairly new to php and im sure i’ve made a horrible beginner mistake.

so i have a autoit script that seeks authorization by querying a mysql database through a php script. but somewhere along the line it loses the variable $hardwareID. now if i convert $hardwareID to a hex before I send it to the PHP script, everything is fine, but this leads to a vastly less “unique” number which raises a few red flags for me.

ID number: 353BF9EC71A018E32F9D2FB28F2C2DEE
hex:00000161

php script

[php]<?php
$email = $_GET [“email”];
$hardwareID = $_GET [“ID”];
echo $hardwareID;
$con = mysql_connect(“DATABASELOC”,“USERNAME”,“PASSWOR”);
if (!$con)
{
die('Could not connect: ’ . mysql_error());
}

mysql_select_db(“DBNAME”, $con);
$result = mysql_query(“SELECT * FROM accounts WHERE accountemail=’$email’”);
$row = mysql_fetch_array($result);
if ($row[1] == 0)
{
echo $row[2];
}
if ($row[1] == 1)
{
if ($row[2] == NULL)
{
$update = mysql_query(“UPDATE accounts SET hardwareIDone=$hardwareID WHERE accountemail=’$email’”);
$result = mysql_query(“SELECT * FROM accounts WHERE accountemail=’$email’”);
$row = mysql_fetch_array($result);
echo $row[2];
}
elseif ($row[2] != $hardwareID)
{
if ($row[3] == NULL)
{
mysql_query(“UPDATE accounts SET hardwareIDtwo=$hardwareID WHERE accountemail=’$email’”);
$result = mysql_query(“SELECT * FROM accounts WHERE accountemail=’$email’”);
$row = mysql_fetch_array($result);
echo $row[2];
}
elseif ($row[3] != $hardwareID)
{
echo “error, hardware ID’s do not match, contact admin to reset IDs”;
}
else
{
echo “hardware ID two valid”;
}
}
else
{
echo “hardware ID one valid”;
}
}

mysql_close($con);
?>[/php]

if i convert the ID to binary before i send it to the PHP script, it shows up in the database perfectly, but because $hardwareID is now in binary and the database is in string form, the IF statements return false

so I’m trying to figure out what is wrong and how I can fix it. would greatly appreciate any pointers and if you could tell me where i’ve gone a bolloxed this all up

Well, I think it is simple. You are passing this item: “353BF9EC71A018E32F9D2FB28F2C2DEE”.
This is interpreted as a string, but you are not using quotes around it. Since the item number contains
letters it is NOT a number, but a string and needs to be quoted.

So:
$update = mysql_query(“UPDATE accounts SET hardwareIDone=$hardwareID WHERE accountemail=’$email’”);
would need to be:
$update = mysql_query(“UPDATE accounts SET hardwareIDone=’$hardwareID’ WHERE accountemail=’$email’”);

Not 100% sure, without testing it all. You did not tell us what your database field for the hardware items were.
So, hard to guess. Let us know if that helps. If not, explain the field definition for the fields involved.
Good luck!

Sponsor our Newsletter | Privacy Policy | Terms of Service