Fun, easy PHP->SQL <script> Problem

PHP SQL <script> update

[campeon87]

Hi all, i am developing a slot machine script that will (at some point) login to a SQL database to verify 'credits' remaining...

Here is the script:

echo "
function checkmatch(){ 
if (........) 
{document.slots.banner.value=\"5 of a kind - You won \"+Math.floor(document.slots.bet.value*50)+\" gold pieces\"; document.slots.gold.value=Math.floor(document.slots.gold.value)+Math.floor(document.slots.bet.value*50)}
else if (.......)
{document.slots.banner.value=\"4 of a Kind - You won \"+Math.floor(document.slots.bet.value*20)+\" gold pieces\";
document.slots.gold.value = Math.floor(document.slots.bet.value*20) + Math.floor(document.slots.gold.value)}
else if (.....)
{document.slots.banner.value=\"Double Pair - You won \"+Math.floor(document.slots.bet.value*3)+\" gold pieces\";
document.slots.gold.value = Math.floor(document.slots.bet.value*3) + Math.floor(document.slots.gold.value)}
else if (.....)
{document.slots.banner.value=\"3 of a Kind - You won \"+Math.floor(document.slots.bet.value*2)+\" gold pieces\";
document.slots.gold.value = Math.floor(document.slots.bet.value*2) + Math.floor(document.slots.gold.value)}
else if (.....)
{document.slots.gold.value=document.slots.gold.value-document.slots.bet.value; 
document.slots.banner.value=\"A Pair - You lost \"+document.slots.bet.value+\" gold pieces\";}
else {document.slots.gold.value=document.slots.gold.value-document.slots.bet.value; 
document.slots.banner.value=\"No match - You lost \"+document.slots.bet.value+\" gold pieces\";}}
</script>"

Note: This is a looping script, triggered by a button.
document.slots.bet.value = Bet Value
document.slots.gold.value = Credits remaining

Somewhere i need to put the SQL update:
"UPDATE $TABLE SET CREDITS = document.slots.gold.value WHERE name = $name"

Can anyone tell me where to enter my SQL Update (so that it is updates the SQL each time the <script> is triggered)

I will credit you in the final script!

[picardo]

Well, the usual way of going about things is to have the user submit to a php script and to run the query with a set of PHP commands. I think you will find that you can't use DOM objects to fetch values from inside a PHP script, and should instead grab the value this way:

$_POST['gold']

Of course you need to sanitize this first, if you don't want to risk your program.

$tainted = $_POST['gold'];

if(is_num($tainted )){
$clean = $tainted ;
}

...and then you need to run this query on the value you get:

UPDATE $TABLE SET CREDITS = $clean WHERE name = $name