[RESOLVED] My First Game Script

[Magfersile]

Well, I've finally completed a small php game that doesn't do much. However, I am eager for feedback on it in any way that I can get. Please take a look at the files if you have time and let me know what you think. How can it be improved? What should I be doing that I'm not doing? Is it completely trash? Noob script? etc. Any input I could get back would be great. Don't forget to rename the files with the extension .php.txt to a file of the same name with the .php extension if you can't get the zip file to work for you.

[Magfersile]

Here are the rest of the files.

[troybtj]

Skimming, I'd suggest putting some of the common things to all pages in a config.php file and require_once('config.php') at the top of each file.

This would be the database connection information, header and footer functions, css, etc.

I only read the code, I didn't run it, so that's all the input I have at the moment.

[Magfersile]

Thanks for posting troybtj. About the putting common code into a single file and including it as needed, I have been getting that alot, but thanks for the input. Do you see anything else that could be improved or done differently?

[ClarkF1]

Instead of including text files with the data that has to be entered manually, include .sql files with the necessary queries so that people can import the data using phpmyadmin

[troybtj]

Looking more at it, you shouldn't use the user input directly in queries.

You can get a good sanitization library here:
http://www.owasp.org

It includes functions to clean up user input to prevent many types of attacks.

It gives you the following functions:


// Function list:
// sanitize_paranoid_string($string) -- input string, returns string stripped of all non
// alphanumeric
// sanitize_system_string($string) -- input string, returns string stripped of special
// characters
// sanitize_sql_string($string) -- input string, returns string with slashed out quotes
// sanitize_html_string($string) -- input string, returns string with html replacements
// for special characters
// sanitize_int($integer) -- input integer, returns ONLY the integer (no extraneous
// characters
// sanitize_float($float) -- input float, returns ONLY the float (no extraneous
// characters)
// sanitize($input, $flags) -- input any variable, performs sanitization
// functions specified in flags. flags can be bitwise
// combination of PARANOID, SQL, SYSTEM, HTML, INT, FLOAT, LDAP,
// UTF8

[Magfersile]

Thanks for your input guys, and thanks to everyone who took the time to look over my code. Feel free to continue posting in this thread if you want, but I am going to mark it as resolved.