sql injection through address bar.

[Marco van Herwaarden]

Well it for sure could get wrong results (there is a little time between calculating and submitting the query). I suggest somehting like the following:

PHP Code:

$move = array();
if (isset($_POST['up']))
{
  $move[] = "move_v = move_v + 10";
    } 
    elseif (isset($_POST['down'])) 
    { 
       $move[] = "move_v = move_v - 10";
    }   

if ($move)
{
  $move_sql = implode(", ", $move);
$query = "UPDATE rpg_character  
     SET  
     $move_sql
     WHERE characterid='".$rpg['characterid']."'"; 
     mysql_query($query);  
} 


Just typed it here, so not tested and probably made a typo somewhere, but you get the idea.

You can add the code to add to the $move array for horizontal yourself.