Need help with PHP stoof

[ryanbowen201046]

ok so im not the best at coding with PHP but im not that bad but could anyone tell my why it dosnt work ;[

the code = http://pastebin.com/UYv4aW9Z
please help! thanks

p.s the script is a user carrd sorta thing..abit like a buisness card but with your user info on it

Site URL - americawars.exofire.net (not finished yet tho..)

 

[descalzo]

How is it failing?

Where does $id come from?

 

[ryanbowen201046]

it was originaly a modification my freind made but i needed to edit it to fit my game ( i have his permission + he gave it out free anyway xP) but i wasnt sure since im new with this game engine

but try http://pastebin.com/icQ3yRBC i dont see anything wrong and i just get a blank screen :/
americawars.exofire.net/usercard.php

ohh i think i know what ive missed i need the ?id=IDHERE lol but i dont know how to do it :/ any help anyone?

 

[misson]

It sounds like the script relies on register_globals, a long deprecated feature of PHP. It is also vulnerable to SQL injection, which is a very serious security risk. To fix this hole, switch from the outdated mysql extension to PDO and use prepared statements. If you need a PDO tutorial, try "Writing MySQL Scripts with PHP and PDO". The site you save may just be your own.

 

[callumacrae]

yourpage.php?id=7%3B%20DROP%20TABLE%20users

All gone!

As misson said, NEVER use register_globals and ALWAYS sanitise user input

~Callum

 

[ryanbowen201046]

Yeh thanks for the help guys but i still cant seem to get it working but i dont mind, could you help me with this one though? http://pastebin.com/UQJCbBKq
(its a flash game arcade my freind made for me ) theres nothing wrong with the code and still gives white blank page -.-
americawars.exofire.net/arcade.php
D:

 

[callumacrae]

Try turning error reporting on. Also, where is that $username variable set? If it is set in logincheck() it will not be in the local variable scope at line 6.

You're still using the ancient mysql_* libraries - you should definitely try something like PDO (read my article on it here)

You shouldn't be using <center>, it has been deprecated, and you shouldn't be using tables for layout

~Callum