<?php
include("./db.php");
header('Access-Control-Allow-Origin: *');

$game = mysqli_real_escape_string($mysqli,$_GET['game']);
$number = mysqli_real_escape_string($mysqli,$_GET['num']);

$sql = mysqli_query ($mysqli, "SELECT * FROM highscores WHERE game='$game' ORDER BY score DESC LIMIT $number");
while($row = mysqli_fetch_array ($sql))
{
  $name = htmlspecialchars($row['name']);
  $score = htmlspecialchars($row['score']);

 if(strlen(strstr($name, "script")) > 0)
 {
 }
 else
 {
  echo "$name $score \n";
 }
}


?>
