There are so many vulnerabilities here its not even funny.
1. You should use PDO.
2. You need to sanatize and check your inputs much better. Look into is is_int, htmlspecialchars with ENT_QUOTES set,
3. String != Number
4. Setting something to null does not mean its not set
5. Your HTML is all messed up
6. Use sessions instead of cookies
6. I ran out of patience and fixed it for you:
(Havent actually tested it, but I am fairly sure it will work.)
<?php
// Includes
require_once('mysqlLogin.php');
// MySQL connection
$connection = new mysqli($db_hostname, $db_username, $db_password, $db_database);
if ($connection->connect_error)
die($connection->connect_error);
// Get account data
$accountNum = mysqli_real_escape_string($connection, $_COOKIE['cookie_account']); // sanitizeNumber?
$query = "SELECT * FROM bank WHERE accountNum='$accountNum'";
$result = $connection->query($query);
if (!$result)
die ($connection->error);
$display = $result->fetch_array(MYSQLI_ASSOC);
// Deposit
if (isset($_POST['deposit'])){
$deposit=sanitizeNumber($_POST['deposit']);
if ($deposit == NULL || $deposit < 0){
die("Invalid deposit value. Must be a number and bigger than zero.");
}
$newMoney=$display['money']+$deposit;
$query="BEGIN";
$connection->query($query);
$query="UPDATE bank SET money=$newMoney WHERE accountNum=$accountNum";
$connection->query($query);
$query="COMMIT";
$connection->query($query);
}
// Withdraw
if (isset($_POST['withdraw'])){
$withdraw=sanitizeNumber($_POST['withdraw']);
if ($withdraw == NULL || $withdraw < 0){
die("Invalid withdraw value. Must be a number and bigger than zero.");
}
$newMoney=$display['money']-$withdraw;
$query="BEGIN";
$connection->query($query);
$query="UPDATE bank SET money=$newMoney WHERE accountNum=$accountNum";
$connection->query($query);
$query="COMMIT";
$connection->query($query);
}
// Refresh data in case of actions above
$query = "SELECT * FROM bank WHERE accountNum=$accountNum";
$result = $connection->query($query);
if (!$result)
die ($connection->error);
$display = $result->fetch_array(MYSQLI_ASSOC);
//display the name and everthing
echo "Account Number: ". htmlspecialchars($display['accountNum'], ENT_QUOTES) ."<br>";
echo "Name: ". htmlspecialchars($display['firstName'], ENT_QUOTES) ."<br>";
echo "LastName: ". htmlspecialchars($display['lastName'], ENT_QUOTES) ."<br>";
echo "Money: ". htmlspecialchars($display['money'], ENT_QUOTES) ."<br>";
$result->close();
$connection->close();
// Function to make sure a input is a number (Int)
function sanitizeNumber($i) {
if(is_numeric($i) && (int)$i==$i)
return TRUE;
return FALSE;
}
?><!DOCTYPE html>
<html lang="en">
<body>
<form method="post" action="accountManagment.php">
<p>Deposit: <input type="number" name="deposit" /></p>
<p><input type="submit" name"submit" value="submit" /></p>
</form>
<br><br>
<form method="post" action="accountManagment.php">
<p>Withdraw: <input type="number" name="withdraw" /></p>
<p><input type="submit" name"submit" value="submit" /></p>
</form>
</body>
</html>
https://gist.github.com/anonymous/222a342f3df49b0b2bf5
