Game leveling system I made this code for simple leveling game.

I think this code may have some issues with security. Also, are there some way to make this code more efficient and reliable?

For level scaling I will use this method. Should I make lvl, xp and nxtlevel variables to array or is that a bad idea?

class LevelingSystem
{

  private $_lvl;
  private $_xp;
  private $_nxtlevel;

  function __construct($lvl=1,$xp=0,$nxtlevel=30)
  {

    $this-&gt;_lvl=$lvl;
    $this-&gt;_xp=$xp;
    $this-&gt;_nxtlevel=$nxtlevel;
  }

  function setxp($setxp)
  {
    global $db;
    $stmt = $db-&gt;prepare("UPDATE user_atri SET totalxp =totalxp+".$setxp." WHERE id=1");
    $updatexp=$stmt-&gt;execute();
    return $updatexp;
  }

  private function getxp()
  {
    global $db;
    $query = $db-&gt;prepare("SELECT totalxp FROM user_atri where id=1");
    $query-&gt;execute();
    $totalxp=$query-&gt;fetch(PDO::FETCH_ASSOC);
    $this-&gt;_xp=$totalxp["totalxp"];
    return $totalxp["totalxp"];
  }

  function lvl()
  {

    $this-&gt;getxp();
    while ($this-&gt;_xp&gt;=$this-&gt;_nxtlevel)
    {
        $this-&gt;_lvl+=1;
        $this-&gt;_xp =$this-&gt;_xp - $this-&gt;_nxtlevel;
        $this-&gt;_nxtlevel = round($this-&gt;_nxtlevel * 1.6);
    }

    //$levelprint=sprintf("Youre level is: %s ",$this-&gt;_lvl);
    //echo $this-&gt;_xp;
    //echo "&lt;br&gt;";
    //return $levelprint;
    return $this-&gt;_lvl;

  }

}
First: in the book 'Refactoring' by Martin Fowler,  one of the code smells is "Obsession with elementary types". And the advice is to create/take out variables and move them to another class. 

Array is an elementary type. The resolution is to create an entity class Settings and set member variables $lvl,$xp,$nxtlevel.

Second: global $db; transfer through object.

Using global variables is bad practice. If you want to use a Database you should create an object for Database access. Best practice use DI. For PHP one such library is php-di.

Your code may look like this:

&lt;?php

  class LevelingSystem {

  private $settings;
  private $db;

  function __construct(SettingsEntity $settings, DBInterface $db ){
    $this-&gt;settings=$settings;
    $this-&gt;db = $db;
  }

  public function setxp($setxp) {
    $result =  $this
                -&gt;db
                -&gt;prepare("UPDATE user_atri SET totalxp =totalxp+" . $setxp . " WHERE id=1")
                -&gt;execute();

    if(!$result) {
       throw new Exception('DB error');  //you can send your exception 
    }        

    return $this;
  }

  public function calcSettings() {
   $xp = $this-&gt;getxp();
   $nxtlevel = $this-&gt;settings-&gt;getNxtlevel();
   $lvl = $this-&gt;settings-&gt;getLvl();

   while ($xp &gt;= $nxtlevel) {
        $lvl += 1;
        $xp = $xp - $nxtlevel;
        $nxtlevel = round($nxtlevel * 1.6);
    }

     $this-&gt;settings
     -&gt;setlvl($lvl)
     -&gt;setXp($xp)
     -&gt;setNxtlevel($nxtlevel);

     return $this;
  }

  public function getLvl() {
      return $this-&gt;settings-&gt;getLvl();
  }

  private function getxp() {
    $totalxp = $db
                -&gt;prepare("SELECT totalxp FROM user_atri where id=1")
                -&gt;execute()
                -&gt;fetch(PDO::FETCH_ASSOC);

    if(!isset($totalxp["totalxp"])) {
       throw new Exception('Some DB error'); //you can send your exception 
    } 

    return $totalxp["totalxp"];
  }
}