Why does the script incorrectly enter information into the DB?

Question

PHP

Hello,
I wrote a counter for unique visitors per day by utm, but it enters incorrect information into the database, i.e. 566 users came through the links, and 61 users entered the database, the rest went to the unregistered ones. What is the problem? Maybe an error in the date check?

$cookie_days      = 30;
$cookie_timestamp = strtotime('+' . $cookie_days . ' days');
if (isset($_GET['ref']) && !empty($_GET['ref'])) {
    setcookie('utm_source', $_GET['ref'], $cookie_timestamp, '/');
    setcookie('ref', $_GET['ref'], $cookie_timestamp, '/');
    setcookie('userh', '', time()-3600);
    header('Location: /');
}
if (isset($_GET['utm_source']) && !empty($_GET['utm_source'])) {
    setcookie('utm_source', $_GET['utm_source'], $cookie_timestamp, '/');
    setcookie('ref', $_GET['utm_source'], $cookie_timestamp, '/');
    setcookie('userh', '', time()-3600);
    header('Location: /');
}


if (!isset($_COOKIE['userh'])) {
    
    setcookie('userh', 'cxv', time() + 86400);
    if (isset($_COOKIE['utm_source'])) {
        $ress = mysql_fetch_assoc(mysql_query("SELECT COUNT(*) as total FROM `utm_counter` WHERE  `fromutm` ='" . $_COOKIE['utm_source']."' AND `datetime` = CURDATE()"));
        if ($ress['total'] == '0') {
            mysql_query("INSERT INTO `utm_counter` (`count`,`fromutm`,datetime) VALUES ('1','" . $_COOKIE['utm_source'] . "',CURDATE())");
        } else {
            $counter  = mysql_fetch_assoc(mysql_query("SELECT count as total FROM `utm_counter` WHERE  `fromutm` ='" . $_COOKIE['utm_source']."' AND `datetime` = CURDATE()"));
            $counters = $counter['total'] + 1;
            mysql_query("UPDATE `utm_counter` SET `count`=" . $counters . " WHERE  `fromutm` ='" . $_COOKIE['utm_source']."' AND `datetime` = CURDATE()");
        }
    } else {
        $ress = mysql_fetch_assoc(mysql_query("SELECT COUNT(*) as total FROM `utm_counter` WHERE `datetime` >= CURDATE() AND `fromutm` = 'without utm'"));
        if ($ress['total'] == '0') {
            mysql_query("INSERT INTO `utm_counter` (`count`,`fromutm`,datetime) VALUES ('1','without utm',CURDATE())");
        } else {
            $counter  = mysql_fetch_assoc(mysql_query("SELECT count as total FROM `utm_counter` WHERE `datetime` >= CURDATE() AND `fromutm` = 'without utm'"));
            $counters = $counter['total'] + 1;
            mysql_query("UPDATE `utm_counter` SET `count`=" . $counters . " WHERE `datetime` >= CURDATE() AND `fromutm` ='without utm'");
        }
    }
}

Answer 1

Let's start with the fact that if I put my value in the cookie, sql injection is possible. mysql_real_escape_string to help. And in general, I thought everyone had already switched to PDO (we smoke php.net/PDO ).
select -> increment -> update are never atomic. What prevents using the build-in functionality ^
Further, in this case, you can easily get rid of the redundant nesting of conditions by defining a variable that stores the utm_source cookie.

$utm_source = isset($_COOKIE['utm_source']) ? $_COOKIE['utm_source'] : 'without utm';
// я бы тут "without utm" заменил на NULL, конечно

Then, select -> if == 0 -> insert else update is shit code. Why this extra request? Use INSERT ON DUPLICATE KEY UPDATE.