Get values from database table with ID from Unity - php

Question

I have a database table with values, the primary key being ID. Now I am trying to receive the values of the table with the referenced ID from Unity. How do I send the referenced ID from Unity to this php file so that only the values from this ID should be received.
Currently I am receiving all the values of the table from all IDs.
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using UnityEngine;
public class CheckForExistingID : MonoBehaviour {
public string[] Items;
public string ID = "001"; //Referenced ID
public string Name;
public string Age;
void Start () {
StartCoroutine (ReceiveValues());
}
IEnumerator ReceiveValues () {
WWW data = new WWW ("http://localhost/GetValue.php?id="+ID);
yield return data;
if (data.error != null) {
print (data.error);
} else {
print ("Received");
dataString = data.text;
Items = dataString.Split (';');
Name = Items[0];
Age = Items[1];
}
}
}
GetValue.php
<?php
...
...
...
$id = $_GET['id'];
$sql = "SELECT Name, Age FROM Students WHERE ID = $id";
$result = mysqli_query($conn, $sql);
if(mysqli_num_rows($result) > 0)
{
while($row = mysqli_fetch_assoc($result)){
echo "".$row['Name'] . ";";
echo "".$row['Age'] . ";";
}
}
?>

Answer 1

NOTE Do NOT use WWW as derHugo had pointed out, it is now obsolete. Similarly sanitize all data using prepared statements. Skip to the edit marker to find an updated answer.
I am not sure you are posting the data properly. You should use a WWWForm, add the fields you want and then handle them on the PHP side. I would also heavily consider adding some form of error handling in PHP with an echo to know if something failed.
On mobile so excuse the formatting for now I'll fix it later if it needs it.
string url = "http://localhost/GetValue.php";
WWWForm form = new WWWForm();
form.AddField("id", "TheIDHere");
WWW www = new WWW(url, form);
yield return www;
...
On the PHP side of things, it can look like
<?php
if (isset($_REQUEST["id"])) {
echo "Received ". $_REQUEST["id"]. " success!";
exit();
} else {
http_status_code(400);
echo "Request Failed";
}
Edit: As pointed out by derHugo, WWW is now obsolete, and is replaced by WebRequests. The above c# code should look like
WWWForm form = new WWWForm();
form.AddField("id", "yourID");
UnityWebRequest www = UnityWebRequest.Post("http://localhost/GetValue.php", form);
yield return www.SendWebRequest();
if (www.result != UnityWebRequest.Result.Success)
{
Debug.Log(www.error);
}
else
{
Debug.Log("Sucess");
}
As well, derHugo had pointed out that you are not sanitizing your data at all, so you would be subject to SQL Injections. Here is roughly what you would want to do to use prepared statements
// prepare a statement using the ID
$stmt = $mysqli->prepare("SELECT Name, Age FROM Students WHERE ID = ?");
// bind the ID from our POST
$stmt->bind_param("i", $_POST['id']);
// execute our prepare statement
$stmt->execute();
// store the result
$stmt->store_result();
// we have no found id
if($stmt->num_rows === 0) exit('No Data');
// bind the results we are looking for from our prepared statement
$stmt->bind_result($idName, $idAge);
// fetch the results from the table
$stmt->fetch();
// echo your results to Unity
echo $idName;
echo $idAge;
// deallocate the statement
$stmt->close();