SWDB/application/action/rate_team.php

<?php
/**
 * File for the team score modification action.
 *
 * Implements an action function to be called from the {@see Controller}.
 *
 * @author Iñigo Valentin <i@inigovalentin.com>
 * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
 * @package SWDB
 */

/**
 * Sets the score for a team.
 *
 * Reads the POST parameters looking for the following KEYS:
 *  player: Owner's player ID.
 *  team: Team ID.
 *  score: New score.
 * Validates the data and sets the score.
 *
 * @return int 201 on success, HTTP erro status codes on error.
 * @category Action
 */
function action(){
    $player_id = filter_input(INPUT_GET, "player");
    $statement = get_context()->get_db()->prepare("
        SELECT count(user) AS c FROM player WHERE id = :player AND user = :user");
    $statement->bindValue(":player", $player_id, SQLITE3_TEXT);
    $statement->bindValue(":user", get_context()->get_user()->get_id(), SQLITE3_TEXT);
    if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 1){
        // The user doesn't own the team.
        return 401;
    }
    $team = filter_input(INPUT_GET, "team");
    $score = intval(filter_input(INPUT_GET, "score"));
    $statement = get_context()->get_db()->prepare("
      UPDATE team
      SET score = :score
      WHERE
        player = :player AND
        id = :team;
    ");
    $statement->bindValue(":score", $score, SQLITE3_TEXT);
    $statement->bindValue(":player", $player_id, SQLITE3_TEXT);
    $statement->bindValue(":team", $team, SQLITE3_TEXT);
    $statement->execute();
    return 201;
}