How can you read and write to a MySQL database starting at a JavaScript web game?
<p>First of all, I'm not much of a programmer if at all. This question may seem silly but I would honestly like some advice from real programmers. </p>

<p>I'd like to make a bit of an adventure game on a webpage. </p>

<p>Could I make it by having a MySQL database setup to store variables while JavaScript, HTML and CSS is used for the user interface and JavaScript for the game programming and PHP to communicate with MySQL. </p>

<p>I don't entirely understand it but I followed a tutorial and got it working. It also showed me how you can replace text on the screen by giving that text an elementid and then just setting its value to other text.</p>

<p>In this tutorial script, it has it so when the JavaScript file wants to communicate with php, it will open the php file with a ?=value at the end of the hyperlink where the value part turns into some kind of MySQL search value. </p>

<p>Something like this:
xmlhttp.onreadystatechange=function()
xmlhttp.open("GET","index.php?q="+str,true);</p>

<p>and then in the PHP file:
$q=$_GET["q"];
$sql="SELECT * FROM user WHERE id = '".$q."'";</p>

<p>This means you will always search by specific id number. The problem with this is that the php file is always set to look at the exact same table. </p>

<p>Sometimes you want to look at different tables, or multiple values from multiple tables, etc. Basically, you should be able to select each value like it's a record from one of those automatic DJs that radio stations used to have. Also, sometimes you'd want to write or append the database like when variables change and need to be updated and all of that has to happen securely. </p>

<p>The only thing I can think of is to have a ton of php files that work the same way and call the appropriate file when you want a certain kind of response. But then if I have a file on my website that has a php file that lets me write TO the database then someone can just read the javascript code, see that, and then basically hijack the mysql database.</p>

<p>So how can I securely do this?</p>
