Php Problem with mysql_query() - authentication

Question

I've been having problems with my php code. I seem to be getting an error from #mysql_query().
Here's my code for php:
<?php
// A simple PHP script demonstrating how to connect to MySQL.
// Press the 'Run' button on the top to start the web server,
// then click the URL that is emitted to the Output tab of the console.
$servername = getenv('IP');
$username = getenv('C9_USER');
$passwordp = "";
$database = "game_database";
$dbport = 3306;
// Create connection
mysql_connect($servername, $username, $passwordp, $dbport)or die("Cant Connect to server");
mysql_select_db($database) or die("Cant connect to database");
// Check connection
$Email = $_REQUEST["Email"];
$Password= $_REQUEST["Password"];
if (!$Email || !$Password){
echo"Email or password must be used";
}
else{
$SQL = "SELECT * FROM 'users' WHERE Email = '" . $Email ."'";
$result_id = #mysql_query($SQL) or die("Database Error");
$Total = mysql_num_rows($result_id);
if ($Total){
$datas = #mysql_fetch_array($result_id);
if (strcmp($Password, $datas["Password"])){
$sql2 = "SELECT Characters FROM users WHERE Email = '" . $Email ."'";
$result_id2 = #mysql_query($sql2) or die("Database Error!!!");
while ($row = mysql_fetch_array($result_id2)){
echo $row ["Characters"];
echo ":";
echo "Success";
}
}
else{
echo "WrongPassword";
}
}else {
echo "NameDoesNotExist";
}
}
?>
Here's my code for C#:
using UnityEngine;
using System.Collections;
using UnityEngine.UI;
public class LoginScript : MonoBehaviour {
#region Variables
//Static Variables
public static string Email = "";
public static string Password = "";
//Private Variables
private string createAccountUrl = "https://credmanager-rowanharley.c9.io/createaccount.php";
private string loginUrl = "https://credmanager-rowanharley.c9.io/loginaccount.php";
private string ConfirmPass= "";
private string CreateEmail = "";
private string CreatePassword = "";
//Public Variables
public string currentMenu = "Login";
//GUI test section
public float X;
public float Y;
public float Width;
public float Height;
#endregion
// Use this for initialization
void Start () {
}
void OnGUI(){
//If current menu is = login call login screen
if (currentMenu == "Login"){
LoginGUI();
}
//If current menu is = Create Account call CreateAccount screen
else if(currentMenu == "CreateAccount"){
CreateAccountGUI();
}
}
//This method will login to accounts
void LoginGUI(){
GUI.Box (new Rect (210, 15, 300, 300), "Login");
if (GUI.Button (new Rect (250, 275, 105, 35), "Register Now!!!")) {
currentMenu = "CreateAccount";
}
if (GUI.Button (new Rect (370, 275, 105, 35), "Login!")) {
StartCoroutine(LoginAccount());
}
GUI.Label(new Rect(225, 55, 290, 100), "Before Continuing you need to login or register.");
GUI.Label(new Rect(215, 102, 100, 100), "Email:");
Email = GUI.TextField (new Rect (330, 100, 150, 25), Email);
GUI.Label(new Rect(215, 150, 100, 100), "Password:");
Password = GUI.TextField (new Rect (330, 147, 150, 25), Password);
}
void CreateAccountGUI(){
GUI.Box (new Rect (210, 15, 300, 300), "Register to save progress");
if (GUI.Button (new Rect (250, 275, 105, 35), "Back")) {
currentMenu = "Login";
}
GUI.Label(new Rect(225, 55, 290, 100), "Register NOW!!!");
GUI.Label(new Rect(215, 102, 100, 100), "Email:");
CreateEmail = GUI.TextField (new Rect (330, 100, 150, 25), CreateEmail);
GUI.Label(new Rect(215, 150, 100, 100), "Password:");
CreatePassword = GUI.TextField (new Rect (330, 147, 150, 25), CreatePassword);
GUI.Label(new Rect(215, 198, 122, 100), "Confirm Password:");
ConfirmPass = GUI.TextField (new Rect (330, 194, 150, 25), ConfirmPass);
GUI.Box (new Rect (210, 15, 300, 300), "Register to save progress");
if (GUI.Button (new Rect (250, 275, 105, 35), "Back")) {
currentMenu = "Login";
}
if (GUI.Button (new Rect (370, 275, 105, 35), "Create Account")) {
if (CreatePassword == ConfirmPass){
StartCoroutine("CreateAccount");
}
else{
Debug.Log("Both Passwords are not the same");
}
}
}
IEnumerator CreateAccount(){
//this sends info to php form
WWWForm CreateAccountForm = new WWWForm ();
CreateAccountForm.AddField ("Email", CreateEmail);
CreateAccountForm.AddField ("Password", CreatePassword);
WWW CreateAccountWWW = new WWW (createAccountUrl, CreateAccountForm);
yield return CreateAccountWWW;
if (CreateAccountWWW.error != null) {
Debug.LogError ("Failed to Create Account. Is Internet On? Is URL Correct? Error Message: " + CreateAccountWWW.error);
} else {
string CreateAccountReturn = CreateAccountWWW.text;
Debug.Log("Successfully Created Account " + CreateEmail);
Application.LoadLevel("MainScene");
}
}
IEnumerator LoginAccount(){
Debug.Log ("Attempting to login...");
WWWForm Form = new WWWForm ();
Form.AddField ("Email", Email);
Form.AddField ("Password", Password);
WWW LoginAccountWWW = new WWW (loginUrl, Form);
yield return LoginAccountWWW;
if (LoginAccountWWW.error != null) {
Debug.LogError("Problem with Database. Error Message: " + LoginAccountWWW.error);
}
else {
string LogText = LoginAccountWWW.text;
Debug.Log(LogText);
string[] LogTextSplit = LogText.Split(':');
if (LogTextSplit[1] == "Success"){
Application.LoadLevel("MainScene");
}
}
}
}
When I press play from unity editor I get error: "Database Error" from #mysql_query() on $result_id.

Answer 1

use query string as format like this
"SELECT m.name FROM test.members WHERE name=%s OR id=%d OR sex IN (%a)", "Evil 'injection'", 'NaN', array('male', 'female', 'both', 'other', "Alien quote'man"));