<?php

// Added these variables for security reasons and because it makes it a bit simpler in my opinion - RC

$name = mysql_real_escape_string($_GET['name']);
$score = mysql_real_escape_string($_GET['score']);
$wave = mysql_real_escape_string($_GET['wave']);

//first the query try to get a riw where the name of the player is = to the name in the url

$query = "SELECT name FROM highscore WHERE name='$name'";

$res = mysql_query($query) or die("Couldn't execute $query: ".mysql_error());



//if the query returns 0 rows the player doesn't exist, if it returns 1 the player already exists

if (mysql_num_rows($res)==0)

{

//the query makes a new row with the player name and the score

// now i want to edit the following to also insert the wave $_GET["wave"]; and on the next function also set to $_GET["wave"];

$query = "INSERT INTO highscore (name, score, wave) VALUES ('$name','$score','$wave')";

mysql_query($query) or die("Couldn't execute $query: ".mysql_error());

}

else

{

//the query looks for the row with name=name in the url and updates his score

$query = "UPDATE highscore SET score='$score', wave='$wave' WHERE name='$name'";

mysql_query($query) or die("Couldn't execute $query: ".mysql_error());

}

?>