0

I am currently building up a website where the user can sign in with his steam account. For that purpose I am using a Steam Authentication Library which you can find here: https://github.com/SmItH197/SteamAuthentication

What I want to do is to save the ID64, the name and the link to the users avatar in my MYSQL database when the user logs into my site. Those things are included in the variables $steamid64, $steamname & $steamavatar. I have written following script to achieve this:

<?php
require '../steamauth/steamauth.php';

if(isset($_SESSION['steamid'])) {

    include_once 'connect.php';
    include_once '../steamauth/userInfo.php';

    $steamid64 = mysqli_real_escape_string($conn, $_SESSION['steam_steamid']);
    $steamname = mysqli_real_escape_string($conn, $_SESSION['steam_personaname']);
    $steamavatar = mysqli_real_escape_string($conn, $_SESSION['steam_avatar']);

    //Error handlers
    //Check for empty fields
    if(empty($steamid64) || empty($steamname) || empty($steamavatar)) {
        header("Location: ../?userdata=empty");
        exit();
    } else {
        //Check if input characters are valid
        if (!preg_match("/^[0-9]*$/", $steamid64)) {
            header("Location: ../?userdata=invalid");
            exit();
        } else {
            //Insert USERDATA into database
            $sql = "INSERT INTO `users` (`steamid64`, `name`, `avatar`) VALUES ('$steamid64', '$steamname', '$steamavatar')";
            mysqli_query($conn, $sql);
            header("Location: ../?userdata=saved");
            exit();
        }
    }

} else {
    header("Location: ../");
    exit();
}

?>

The script checks if the user is signed in by "if(isset($_SESSION['steamid]))", then proceeds to go through some error handlers and then sends a query to my database inserting the information that are in my variables.

My problem is that my script doesn't work, I am not sure what exactly is happening (that's why I am asking) but it just doesn't create a new entry in my database.

Below you can find steamauth.php, connect.php and userInfo.php. I hope this is enough to solve my problem. If you need any more information do not hesitate to comment below, I will gladly provide it. Thank you for your effort!

steamauth.php: https://github.com/SmItH197/SteamAuthentication/blob/master/steamauth/steamauth.php

userInfo.php:

<?php
if (empty($_SESSION['steam_uptodate']) or empty($_SESSION['steam_personaname'])) {
    require 'SteamConfig.php';
    $url = file_get_contents("http://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=".$steamauth['apikey']."&steamids=".$_SESSION['steamid']); 
    $content = json_decode($url, true);
    $_SESSION['steam_steamid'] = $content['response']['players'][0]['steamid'];
    $_SESSION['steam_communityvisibilitystate'] = $content['response']['players'][0]['communityvisibilitystate'];
    $_SESSION['steam_profilestate'] = $content['response']['players'][0]['profilestate'];
    $_SESSION['steam_personaname'] = $content['response']['players'][0]['personaname'];
    $_SESSION['steam_lastlogoff'] = $content['response']['players'][0]['lastlogoff'];
    $_SESSION['steam_profileurl'] = $content['response']['players'][0]['profileurl'];
    $_SESSION['steam_avatar'] = $content['response']['players'][0]['avatar'];
    $_SESSION['steam_avatarmedium'] = $content['response']['players'][0]['avatarmedium'];
    $_SESSION['steam_avatarfull'] = $content['response']['players'][0]['avatarfull'];
    $_SESSION['steam_personastate'] = $content['response']['players'][0]['personastate'];
    if (isset($content['response']['players'][0]['realname'])) { 
           $_SESSION['steam_realname'] = $content['response']['players'][0]['realname'];
       } else {
           $_SESSION['steam_realname'] = "Real name not given";
    }
    $_SESSION['steam_primaryclanid'] = $content['response']['players'][0]['primaryclanid'];
    $_SESSION['steam_timecreated'] = $content['response']['players'][0]['timecreated'];
    $_SESSION['steam_uptodate'] = time();
}
$steamprofile['steamid'] = $_SESSION['steam_steamid'];
$steamprofile['communityvisibilitystate'] = $_SESSION['steam_communityvisibilitystate'];
$steamprofile['profilestate'] = $_SESSION['steam_profilestate'];
$steamprofile['personaname'] = $_SESSION['steam_personaname'];
$steamprofile['lastlogoff'] = $_SESSION['steam_lastlogoff'];
$steamprofile['profileurl'] = $_SESSION['steam_profileurl'];
$steamprofile['avatar'] = $_SESSION['steam_avatar'];
$steamprofile['avatarmedium'] = $_SESSION['steam_avatarmedium'];
$steamprofile['avatarfull'] = $_SESSION['steam_avatarfull'];
$steamprofile['personastate'] = $_SESSION['steam_personastate'];
$steamprofile['realname'] = $_SESSION['steam_realname'];
$steamprofile['primaryclanid'] = $_SESSION['steam_primaryclanid'];
$steamprofile['timecreated'] = $_SESSION['steam_timecreated'];
$steamprofile['uptodate'] = $_SESSION['steam_uptodate'];
// Version 3.2
?>

connect.php (connection settings for mysql):

<?php
$dbServername = "removed";
$dbUsername = "removed";
$dbPassword = "removed";
$dbName = "removed";

$conn = mysqli_connect($dbServername, $dbUsername, $dbPassword, $dbName);
user2324232322
  • 303
  • 2
  • 6
  • 16
  • Have you checked your web server's error logs? – Jay Blanchard Jul 28 '17 at 19:11
  • No, I will enable error logs now and see if anything pops up. – user2324232322 Jul 28 '17 at 19:13
  • No errors in the logs – user2324232322 Jul 28 '17 at 19:21
  • Then the variables must be empty when you try the insert. – Jay Blanchard Jul 28 '17 at 19:22
  • **WARNING**: When using `mysqli` you should be using [parameterized queries](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add user data to your query. **DO NOT** use manual escaping and string interpolation or concatenation to accomplish this because you will create severe [SQL injection bugs](http://bobby-tables.com/). Accidentally unescaped data is a serious risk. Using bound parameters is less verbose and easier to review to check you’re doing it properly. – tadman Jul 28 '17 at 19:25
  • @JayBlanchard Are you sure that the connection to steamauth.php is working? Because one concern I have is that the connection is just not working – user2324232322 Jul 28 '17 at 19:32
  • 1
    @tadman Thanks, I will update my code! – user2324232322 Jul 28 '17 at 19:32
  • not sure either ... but i would try to use empty instead of isset on line `if(isset($_SESSION['steamid'])) {` – Shuyi Jul 28 '17 at 19:32

0 Answers0