Shop subtract problem help

Hello i currently need help with my shop system.

I'm trying to check if the user have enough point to buy that item.
Here my script below

<?php
$username = $_SESSION['Username'];
include("database.php");
session_start();
$result = mysql_query("SELECT COUNT(image) FROM Shop WHERE username='".$_SESSION['Username']."'");
$row = mysql_fetch_array($result);
$res = mysql_query("SELECT * FROM Shop WHERE username='".$_SESSION['Username']."'");
$r = mysql_fetch_array($res);
if($row['Point'] =="100"){
echo"Sorry you don't have enough point";
}
elseif($r['image'] ==""){
echo"<font color=red>You did not buy anything<br/> 0-0! WHY!</font><br/><a href=Shop_menu.php>Back</a>";
}
else{
echo"You have <font color=blue>".$row['COUNT(image)']."</font> items<br/> Now buy more<br/><a href=Shop_menu.php>Back</a>";
}
?>

I look everywhere online for video & study on how to create this script but no luck.

If you can help me i will be happy & thankful.

A true developer

It's easy. You have to select from the users table and the shop table and then compare them, so it would be:

<?php
$username=$_SESSION['Username'];
$id=$_GET['id'];
include("database.php");
session_start();
$points=mysql_query("SELECT * FROM users WHERE username='$username'");
$user=mysql_fetch_array($user);
$shop=mysql_query("SELECT * FROM shop WHERE id='$id'");
$row=mysql_fetch_array($shop);
if($user['cash']<$row['cash'])
{
echo 'Not enough cash.';
}
if($user['cash']=$row['cash'])
{
echo 'Successful.';
}
?>

...

The distinguished 11DraGo spake:

It's easy. You have to select from the users table and the shop table and then compare them, so it would be:

<?php
$username=$_SESSION['Username'];
$id=$_GET['id'];
include("database.php");
session_start();
$points=mysql_query("SELECT * FROM users WHERE username='$username'");
$user=mysql_fetch_array($user);
$shop=mysql_query("SELECT * FROM shop WHERE id='$id'");
$row=mysql_fetch_array($shop);
if($user['cash']<$row['cash'])
{
echo 'Not enough cash.';
}
if($user['cash']=$row['cash'])
{
echo 'Successful.';
}
?>

You should pretty much always use "include()" and "session_start()" at the beginning of the file. Also, you didn't even sanitize or validate the id. :O And your comparison was not what should be done. o.o

This is a better way (you should be using PDO or MySQLi by the way):

---

<?php
include "database.php";
session_start();

if(isset($_SESSION["user"])){
$user = $_SESSION["user"];
}

else{ header("location: login.php");
exit();
}

if(isset($_GET["id"]) && ctype_digit($_GET["id"])){

//filter_var() would be better than ctype_digit()

$id = (int) $_GET["id"]; typecast as in integer

$my_cash = mysql_fetch_row(mysql_query("SELECT cash_row FROM user_table WHERE LOWER(user_field)='" . strtolower($user) . "'"));

$cost = mysql_fetch_row(mysql_query("SELECT item_cost,item_name FROM shop WHERE id='$id'"));

if($my_cash[0] >= $cost[0]){
echo "You purchased " . $cost[1] . "!";

$cash = $my_cash[0] - $cost;

mysql_query("INSERT INTO user_apps(item,username) VALUES('$cost[1]','$user')");

mysql_query("UPDATE user_table SET cash_field='$cash' WHERE LOWER(user_field)='$cash' LIMIT 1");
}

else{
echo "You don't have enough to purchase that...";
}


}
?>

---

Something like that should get you started. You'll have to do the error handling yourself though. :P

It's my job to help the next generation, and set a good example for them. And for that I'll gladly lay down my life.

Thank you very much for your help guys.

A true developer

Ok got it here my finial script

<?php
$id =$_POST['id'];
$image = $_GET['avatar'];
$point = $_GET['point'];
session_start();
$username = $_SESSION['Username'];
include("database.php");
session_start();
$result = mysql_query("SELECT * FROM Shop WHERE username='".$_SESSION['Username']."' and image='$image'");
$row = mysql_fetch_array($result);
$Check = mysql_query("SELECT * FROM users WHERE username='".$_SESSION['Username']."'and Point1");
$Check2 = mysql_fetch_array($Check);
if($point>$Check2['Point1']) {
echo"Sorry you dont have encough points";
}
elseif($row['image'] =="$image"){
echo"<font color=red>You already buy this Buy another one :)<br/><a href=/Shop/>Back</a></font>";
}
elseif($image ==""){
echo"";
}
else{
session_start();
include("database.php");
mysql_query("UPDATE users Set Point1=Point1 -$point WHERE username='".$_SESSION['Username']."'");
mysql_query("INSERT INTO Shop(id,image,username)VALUES('$id','$image','$username')");
echo"<font color=green>Thank you for buying, Buy more!<br/><a href='/Shop/'>Back</a></font>";
}
?>

A true developer

You could've atleast let me feel skilled. :D

...