├── crons
    ├── index.php
    ├── cron_hour.php
    ├── cron_minute.php
    ├── cron_fivemins.php
    └── cron_day.php
├── ipbans
    └── index.htm
├── logo.gif
├── logo.png
├── banner.jpg
├── banner1.jpg
├── bargreen.gif
├── barred.gif
├── composer.json
├── donator.gif
├── app.json
├── mysql.php
├── admin.news
├── jailuser.php
├── mailban.php
├── ad.php
├── logout.php
├── css
    └── game.css
├── page_loader.php
├── composer.lock
├── challenges
    ├── challenge_6.md
    ├── challenge_5.md
    ├── challenge_4.md
    ├── challenge_3.md
    ├── challenge_1.md
    └── challenge_2.md
├── generalpage.php
├── setup_mysql.php
├── loggedin.php
├── voting.php
├── search.php
├── monopaper.php
├── votetrpg.php
├── donatordone.php
├── oclog.php
├── votetwg.php
├── hospital.php
├── criminal.php
├── searchname.php
├── usersonline.php
├── preferences_c5_changepic.php
├── staffnotes.php
├── README.md
├── willpdone.php
├── preport.php
├── events.php
├── attacklost.php
├── authenticate.php
├── login.php
├── iteminfo.php
├── fedjail.php
├── dlarchive.php
├── battletent.php
├── index.php
├── itembuy.php
├── docrime.php
├── inventory.php
├── monorail.php
├── imadd.php
├── gamerules.php
├── explore.php
├── willpotion.php
├── estate.php
├── userlist.php
├── shops.php
├── attackhosp.php
├── js
    └── login.js
├── roulette.php
├── slotsmachine.php
├── attackwon.php
├── number.php
├── itemsell.php
├── education.php
├── advsearch.php
├── attackleave.php
├── itemuse.php
├── gym.php
├── attackmug.php
├── stats.php
├── sendcash.php
├── itemsend.php
├── hirespy.php
├── crystaltemple.php
├── bank.php
├── register.php
├── cyberbank.php
├── slotsmachine3.php
├── stafflist.php
├── slotsmachine2.php
├── header.php
├── preferences_c5.php
├── cmarket.php
└── mainmenu.php


/crons/index.php:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/ipbans/index.htm:
--------------------------------------------------------------------------------
1 | <font color=red size=+2>403 Error<br />
2 | Not allowed to access this page</font>


--------------------------------------------------------------------------------
/logo.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/logo.gif


--------------------------------------------------------------------------------
/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/logo.png


--------------------------------------------------------------------------------
/banner.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/banner.jpg


--------------------------------------------------------------------------------
/banner1.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/banner1.jpg


--------------------------------------------------------------------------------
/bargreen.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/bargreen.gif


--------------------------------------------------------------------------------
/barred.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/barred.gif


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
1 | {
2 |   "require": {
3 |     "ext-mysql": "*",
4 |     "ext-mbstring":"*"
5 |   }
6 | }


--------------------------------------------------------------------------------
/donator.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/breakthenet/HackMe-File-Upload-Challenges/master/donator.gif


--------------------------------------------------------------------------------
/app.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "addons": [
 3 |     "papertrail",
 4 |     "cleardb"
 5 |   ],
 6 |   "success_url": "/login.php",
 7 |   "scripts": {
 8 |     "postdeploy": "php setup_mysql.php"
 9 |   }
10 | }
11 | 


--------------------------------------------------------------------------------
/mysql.php:
--------------------------------------------------------------------------------
1 | <?php
2 | $mysql_string = getenv('CLEARDB_DATABASE_URL');
3 | $mysql_url = parse_url($mysql_string);
4 | 
5 | $c = mysql_connect($mysql_url['host'], $mysql_url['user'], $mysql_url['pass']) or die(mysql_error());
6 | $db_name = str_replace("/", "", $mysql_url['path']);
7 | mysql_select_db($db_name, $c);


--------------------------------------------------------------------------------
/admin.news:
--------------------------------------------------------------------------------
1 | <b>1) If you are confused with something, please mail id :1</b><br />
2 | <b>2) If you use your powers to cheat. You will get fedjailed for long time. There will be no second chances.</b><br />
3 | <b>3) IP : 127.0.0.1 is standard, if you see with ip 127.0.0.1, it doesn't mean they have multis.</b><br />
4 | <br />


--------------------------------------------------------------------------------
/jailuser.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | if (!isset($_GET['userid']) || !is_numeric($_GET['userid']))
 4 | {
 5 |     exit;
 6 | }
 7 | require "global_func.php";
 8 | $location =
 9 |         'http://' . determine_game_urlbase()
10 |                 . '/new_staff.php?action=fedform&XID=' . $_GET['userid'];
11 | header('Location: ' . $location);
12 | exit;
13 | 


--------------------------------------------------------------------------------
/mailban.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | if (!isset($_GET['userid']) || !is_numeric($_GET['userid']))
 4 | {
 5 |     exit;
 6 | }
 7 | require "global_func.php";
 8 | $location =
 9 |         'http://' . determine_game_urlbase()
10 |                 . '/new_staff.php?action=mailform&XID=' . $_GET['userid'];
11 | header('Location: ' . $location);
12 | exit;
13 | 


--------------------------------------------------------------------------------
/crons/cron_hour.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | require_once(dirname(__FILE__) . "/../mysql.php");
 4 | require_once(dirname(__FILE__) . "/../global_func.php");
 5 | $cron_code = '4f155ea3c4a19a5d37420b1158111a78';
 6 | if ($argc == 2)
 7 | {
 8 |     if ($argv[1] != $cron_code)
 9 |     {
10 |         exit;
11 |     }
12 | }
13 | else if (!isset($_GET['code']) || $_GET['code'] !== $cron_code)
14 | {
15 |     exit;
16 | }
17 | 


--------------------------------------------------------------------------------
/ad.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | require "mysql.php";
 4 | $_GET['ad'] = abs(@intval($_GET['ad']));
 5 | mysql_query("UPDATE ads SET adCLICKS=adCLICKS+1 WHERE adID='{$_GET['ad']}'",
 6 |         $c);
 7 | $q = mysql_query("SELECT adURL FROM ads WHERE adID='{$_GET['ad']}'", $c);
 8 | if (mysql_num_rows($q) > 0)
 9 | {
10 |     header("Location: " . mysql_result($q, 0, 0));
11 | }
12 | else
13 | {
14 |     die("Invalid ad.");
15 | }
16 | 


--------------------------------------------------------------------------------
/crons/cron_minute.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | require_once(dirname(__FILE__) . "/../mysql.php");
 4 | $cron_code = '4f155ea3c4a19a5d37420b1158111a78';
 5 | if ($argc == 2)
 6 | {
 7 |     if ($argv[1] != $cron_code)
 8 |     {
 9 |         exit;
10 |     }
11 | }
12 | else if (!isset($_GET['code']) || $_GET['code'] !== $cron_code)
13 | {
14 |     exit;
15 | }
16 | mysql_query("UPDATE users SET hospital=hospital-1 WHERE hospital>0", $c);
17 | 
18 | 


--------------------------------------------------------------------------------
/logout.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | $sessid = $_SESSION['userid'];
 5 | $atk = $_SESSION['attacking'];
 6 | 
 7 | if ($_SESSION['attacking'])
 8 | {
 9 |     print "You lost all your EXP for running from the fight.<br />";
10 |     require "mysql.php";
11 |     global $c;
12 |     mysql_query("UPDATE users SET exp=0 WHERE userid=$sessid", $c);
13 |     $_SESSION['attacking'] == 0;
14 |     session_unset();
15 |     session_destroy();
16 |     die("<a href='login.php'>Continue login...</a>");
17 | }
18 | session_unset();
19 | session_destroy();
20 | header("Location: login.php");
21 | 
22 | 


--------------------------------------------------------------------------------
/css/game.css:
--------------------------------------------------------------------------------
 1 | @CHARSET "ISO-8859-1";
 2 | 
 3 | body {
 4 | 	font-family: helvetica, arial, geneva, sans-serif;
 5 | 	font-size: 9pt;
 6 | 	color: black;
 7 | 	scrollbar-base-color: #005B70;
 8 | 	scrollbar-arrow-color: #F3960B;
 9 | 	scrollbar-DarkShadow-Color: #000000;
10 | }
11 | 
12 | a:visited,a:active,a:hover,a:link {
13 | 	color: black;
14 | 	text-decoration: none;
15 | }
16 | 
17 | table,tr,td {
18 | 	font-family: helvetica, arial, geneva, sans-serif;
19 | 	font-size: 9pt;
20 | }
21 | 
22 | img {
23 | 	border: none;
24 | }
25 | 
26 | textarea {
27 | 	font-family: helvetica, arial, geneva, sans-serif;
28 | 	font-size: 9pt;
29 | 	color: black;
30 | }


--------------------------------------------------------------------------------
/page_loader.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | include "mysql.php";
13 | global $c;
14 | $is =
15 |         mysql_query(
16 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
17 |                 $c) or die(mysql_error());
18 | $ir = mysql_fetch_array($is);
19 | check_level();
20 | $fm = money_formatter($ir['money']);
21 | $cm = money_formatter($ir['crystals'], '');
22 | $lv = date('F j, Y, g:i a', $ir['laston']);
23 | 
24 | include($_GET['page']);


--------------------------------------------------------------------------------
/composer.lock:
--------------------------------------------------------------------------------
 1 | {
 2 |     "_readme": [
 3 |         "This file locks the dependencies of your project to a known state",
 4 |         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
 5 |         "This file is @generated automatically"
 6 |     ],
 7 |     "hash": "4032f9a7678ad10ae1a13e7369f85d34",
 8 |     "content-hash": "a243a4e7654fee2a753e9fd9e0f4aec1",
 9 |     "packages": [],
10 |     "packages-dev": [],
11 |     "aliases": [],
12 |     "minimum-stability": "stable",
13 |     "stability-flags": [],
14 |     "prefer-stable": false,
15 |     "prefer-lowest": false,
16 |     "platform": {
17 |         "ext-mysql": "*",
18 |         "ext-mbstring": "*"
19 |     },
20 |     "platform-dev": []
21 | }
22 | 


--------------------------------------------------------------------------------
/challenges/challenge_6.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 6
 2 | 
 3 | ----------------------
 4 | 
 5 | Hey, I've been talking to my co-owner, and he doesn't believe me that these vulnerabilities we've had are a big deal.
 6 | 
 7 | I need something from you I could give him that would show him the magnitude of the problem.
 8 | 
 9 | What exactly can you do with these vulnerabilities? Can you see how far you can take them?
10 | 
11 | A friend passed along this [php web shell](https://github.com/breakthenet/Tools-and-Techniques/blob/master/tools/shell.php) - try it out, the username is "breakthe" and the pass is "net". You'll have to figure out how to upload it yourself (use any of the upload pages on the server).
12 | 
13 | Thanks!
14 | 
15 | -Breakthenet Game Owner
16 | 


--------------------------------------------------------------------------------
/generalpage.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $h->endpage();
28 | 


--------------------------------------------------------------------------------
/setup_mysql.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | session_start();
 3 | require "global_func.php";
 4 | include "mysql.php";
 5 | $is = mysql_query("SELECT * FROM users", $c) or die(set_mysql());
 6 | 
 7 | function set_mysql() {
 8 |     //Only executed if table does not exist
 9 |     $c = mysql_connect($db_hostname, $db_username, $db_password);
10 |     mysql_select_db($db_database, $c);
11 |     $e_db_hostname = addslashes($db_hostname);
12 |     $e_db_username = addslashes($db_username);
13 |     $e_db_password = addslashes($db_password);
14 |     $e_db_database = addslashes($db_database);
15 |     
16 |     $fo = fopen("dbdata.sql", "r");
17 |     $query = '';
18 |     $lines = explode("\n", fread($fo, 1024768));
19 |     fclose($fo);
20 |     foreach ($lines as $line)
21 |     {
22 |         if (!(strpos($line, "--") === 0) && trim($line) != '')
23 |         {
24 |             $query .= $line;
25 |             if (!(strpos($line, ";") === FALSE))
26 |             {
27 |                 mysql_query($query);
28 |                 $query = '';
29 |             }
30 |         }
31 |     }
32 | 
33 | }


--------------------------------------------------------------------------------
/loggedin.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i:s a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print
28 |         "<h1>You have logged on, {$ir['username']}!</h1>
29 | <h2>Welcome back, your last visit was: $lv.</h2>";
30 | $q = mysql_query("SELECT * FROM papercontent LIMIT 1", $c);
31 | $content = mysql_result($q, 0, 0);
32 | print "breakthenet Latest News:<br />
33 | $content
34 | ";
35 | $h->endpage();
36 | 


--------------------------------------------------------------------------------
/voting.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print
28 |         "<h3>Voting</h3>
29 | Here you may vote for breakthenet at various RPG toplists and be rewarded.<br />
30 | <a href='http://apexwebgaming.com/in/498'>Vote at APEX (no reward)</a><br />
31 | <a href='votetwg.php'>Vote at TWG (20% energy restore)</a><br />
32 | <a href='votetrpg.php'>Vote at TOPRPG (\$300)</a>";
33 | 
34 | $h->endpage();
35 | 


--------------------------------------------------------------------------------
/crons/cron_fivemins.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | require_once(dirname(__FILE__) . "/../mysql.php");
 4 | require_once(dirname(__FILE__) . "/../global_func.php");
 5 | $cron_code = '4f155ea3c4a19a5d37420b1158111a78';
 6 | if ($argc == 2)
 7 | {
 8 |     if ($argv[1] != $cron_code)
 9 |     {
10 |         exit;
11 |     }
12 | }
13 | else if (!isset($_GET['code']) || $_GET['code'] !== $cron_code)
14 | {
15 |     exit;
16 | }
17 | // update for all users
18 | $allusers_query =
19 |         "UPDATE `users`
20 |         SET `brave` = LEAST(`brave` + ((`maxbrave` / 10) + 0.5), `maxbrave`),
21 |         `hp` = LEAST(`hp` + (`maxhp` / 3), `maxhp`),
22 |         `will` = LEAST(`will` + 10, `maxwill`)";
23 | mysql_query($allusers_query, $c);
24 | //enerwill update
25 | $en_nd_query =
26 |         "UPDATE `users`
27 |         SET `energy` = LEAST(`energy` + (`maxenergy` / 12.5), `maxenergy`)
28 |         WHERE `donatordays` = 0";
29 | $en_don_query =
30 |         "UPDATE `users`
31 |         SET `energy` = LEAST(`energy` + (`maxenergy` / 6), `maxenergy`)
32 |         WHERE `donatordays` > 0";
33 | mysql_query($en_nd_query, $c);
34 | mysql_query($en_don_query, $c);
35 | 


--------------------------------------------------------------------------------
/search.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print
28 |         "<h3>Search</h3>
29 | <b>Search by Name</b><form action='searchname.php' method='get'>
30 | <input type='text' name='name' /><br />
31 | <input type='submit' value='Search' /></form><hr />
32 | <b>Search by ID</b><form action='viewuser.php' method='get'>
33 | <input type='text' name='u' /><br />
34 | <input type='submit' value='Search' /></form>";
35 | $h->endpage();
36 | 


--------------------------------------------------------------------------------
/monopaper.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print "<h3>The MonoPaper</h3>";
28 | $q = mysql_query("SELECT * FROM papercontent LIMIT 1", $c);
29 | $content = mysql_result($q, 0, 0);
30 | print
31 |         "<table width=75% border=1><tr><td>&nbsp;</td> <td><a href='gym.php'>LOCAL GYM</a></td> <td><a href='halloffame.php'>HALL OF FAME</a></td></tr><tr><td><img src='http://img190.imageshack.us/img190/6798/ad1za.png' alt='Ad' /></td><td colspan=2>$content</td></tr>
32 | </table>";
33 | $h->endpage();
34 | 


--------------------------------------------------------------------------------
/challenges/challenge_5.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 5
 2 | 
 3 | ----------------------
 4 | 
 5 | ...
 6 | 
 7 | Ok, I will cease listening to users - can't trust them. I dropped support for the "1337" extension - and to be safe, I quarantined the preferences in an iframe (I heard iframes can help contain hackers). You'll have to be more creative if you want to get past my code now! 
 8 | 
 9 | The new code is available in game, you'll see it in the menu on the left with the title "Preferences: Challenge 5".
10 | 
11 | -Breakthenet Game Owner
12 | 
13 | ----------------------
14 | 
15 | Stuck? 
16 | ----------------------
17 | <details> 
18 |   <summary>Click for hint 1</summary>
19 |   His iframe idea was both a bad idea and poorly coded, and merits investigation.
20 | </details>
21 | 
22 | <details> 
23 |   <summary>Click for hint 2</summary>
24 |    Does the include() php function care what the extension of the file is?
25 | </details>
26 | 
27 | <details> 
28 |   <summary>Click for hint 3</summary>
29 |    This challenge is two-part. Part 1 is getting your code to a local file on his server (with an image extension). Part 2 is using the local file inclusion vulnerability to load in your 'image' as though it was code.
30 | </details>
31 | 
32 | 
33 | 
34 | 


--------------------------------------------------------------------------------
/challenges/challenge_4.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 4
 2 | 
 3 | ----------------------
 4 | 
 5 | This is driving me nuts - the arcane knowledge required for your last trick is ridiculous.
 6 | 
 7 | I noticed a trend in all your exploits though. You required the file to end with .php to get your code to run. I'm going to go back to my file extension checker and just fix that up to ONLY check the last extension on a file. I also got a request in my forums to support an obscure image format called "1337", so I'm adding that to the whitelist.
 8 | 
 9 | The new code is available in game, you'll see it in the menu on the left with the title "Preferences: Challenge 4".
10 | 
11 | Thanks again for your help!
12 | 
13 | -Breakthenet Game Owner
14 | 
15 | ----------------------
16 | 
17 | Stuck? 
18 | ----------------------
19 | <details> 
20 |   <summary>Click for hint 1</summary>
21 |   1337...? Wth? What is that an extension for?
22 | </details>
23 | 
24 | <details> 
25 |   <summary>Click for hint 2</summary>
26 |    How does apache handle files with multiple file extensions? 
27 | </details>
28 | 
29 | <details> 
30 |   <summary>Click for major hint 3</summary>
31 |    Apache uses last known extension if multiple extensions present 
32 | </details>
33 | 
34 | 
35 | 
36 | 


--------------------------------------------------------------------------------
/votetrpg.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | //$h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $q =
26 |         mysql_query(
27 |                 "SELECT * FROM votes WHERE userid=$userid AND list='trpg'",
28 |                 $c);
29 | if (mysql_num_rows($q))
30 | {
31 |     $h->startheaders();
32 |     $h->userdata($ir, $lv, $fm, $cm);
33 |     $h->menuarea();
34 |     print "You have already voted at TOPRPG today!";
35 |     $h->endpage();
36 | }
37 | else
38 | {
39 |     mysql_query("INSERT INTO votes values ($userid,'trpg')", $c);
40 |     mysql_query("UPDATE users SET money=money+300 WHERE userid=$userid", $c);
41 |     header("Location:http://www.toprpgames.com/vote.php?idno=757");
42 |     exit;
43 | }
44 | 


--------------------------------------------------------------------------------
/donatordone.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($_GET['action'] == "cancel")
28 | {
29 |     print "You have cancelled your donation. Please donate later...";
30 | }
31 | else if ($_GET['action'] == "done")
32 | {
33 |     if (!$_GET['tx'])
34 |     {
35 |         die("Get a life.");
36 |     }
37 |     mysql_query(
38 |             "INSERT INTO dps_process VALUES(NULL,$userid," . time()
39 |                     . ",'{$_GET['type']}');", $c);
40 |     print
41 |             "Your donation has been processed. An admin will check it and you should be credited in about 24-48 hours.";
42 | }
43 | $h->endpage();
44 | 


--------------------------------------------------------------------------------
/oclog.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['ID'] = abs((int) $_GET['ID']);
28 | if (!$_GET['ID'])
29 | {
30 |     die("Incorrect usage of file.");
31 | }
32 | $q = mysql_query("SELECT * FROM oclogs WHERE oclID={$_GET['ID']}", $c);
33 | $r = mysql_fetch_array($q);
34 | print
35 |         "Here is the detailed view on this crime.<br />
36 | <b>Crime:</b> {$r['ocCRIMEN']}<br />
37 | <b>Time Executed:</b> " . date('F j, Y, g:i:s a', $r['ocTIME'])
38 |                 . "<br />
39 |                 {$r['oclLOG']}<br /><br />
40 | <b>Result:</b> {$r['oclRESULT']}<br />
41 | <b>Money Made:</b> \${$r['oclMONEY']}";
42 | $h->endpage();
43 | 


--------------------------------------------------------------------------------
/challenges/challenge_3.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 3
 2 | 
 3 | ----------------------
 4 | 
 5 | Geez. This is harder than I thought. Ok, based on your advice I dropped the client-side mime type validation and am trying something new.
 6 | 
 7 | The code should now actually validate that what is being uploaded is a real image, with real dimensions and real mime-types.
 8 | 
 9 | There's no way you should be able to bust past this one.
10 | 
11 | It's available in game, you'll see it in the menu on the left with the title "Preferences: Challenge 3".
12 | 
13 | Thanks again for your help!
14 | 
15 | -Breakthenet Game Owner
16 | 
17 | ----------------------
18 | 
19 | Stuck? 
20 | ----------------------
21 | <details> 
22 |   <summary>Click for hint 1</summary>
23 |   You must upload a valid image on this one (no way to get around that).
24 | </details>
25 | 
26 | <details> 
27 |   <summary>Click for hint 2</summary>
28 |    PHP ignores anything outside of the <? and ?> tags.
29 | </details>
30 | 
31 | <details> 
32 |   <summary>Click for hint 3</summary>
33 |    You can actually insert a comment inside a GIF, which anything processing that GIF ignores. That comment could be anything... it could even have characters like < and ? in it. [GIMP, a free software for manipulating images, will allow you to insert comments in gifs.](http://s116.photobucket.com/user/bayououtdoor/media/gifcomment.gif.html)
34 | </details>
35 | 
36 | 
37 | 
38 | 


--------------------------------------------------------------------------------
/votetwg.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | //$h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $q =
26 |         mysql_query(
27 |                 "SELECT * FROM votes WHERE userid=$userid AND list='twg'", $c);
28 | if (mysql_num_rows($q))
29 | {
30 |     $h->startheaders();
31 |     $h->userdata($ir, $lv, $fm, $cm);
32 |     $h->menuarea();
33 |     print "You have already voted at TWG today!";
34 |     $h->endpage();
35 | }
36 | else
37 | {
38 |     mysql_query("INSERT INTO votes values ($userid,'twg')", $c);
39 |     mysql_query(
40 |             "UPDATE users SET energy=energy+maxenergy/5 WHERE userid=$userid",
41 |             $c);
42 |     mysql_query("UPDATE users SET energy=maxenergy WHERE energy>maxenergy", $c);
43 |     header("Location:http://www.topwebgames.com/in.asp?id=3341");
44 |     exit;
45 | }
46 | 


--------------------------------------------------------------------------------
/hospital.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print
28 |         "<h3>Hospital</h3>
29 | <table width='75%' border='2'><tr bgcolor=gray><th>ID</th><th>Name</th <th>Level</th> <th>Time</th><th>Reason</th></tr>";
30 | $q =
31 |         mysql_query(
32 |                 "SELECT u.*,c.* FROM users u WHERE u.hospital > 0 ORDER BY u.hospital DESC",
33 |                 $c);
34 | while ($r = mysql_fetch_array($q))
35 | {
36 |     print
37 |             "\n<tr><td>{$r['userid']}</td><td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> [{$r['userid']}]</td><td>
38 |             {$r['level']}</td><td>{$r['hospital']} minutes</td><td>{$r['hospreason']}</td></tr>";
39 | }
40 | print "</table>";
41 | $h->endpage();
42 | 


--------------------------------------------------------------------------------
/criminal.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $q = mysql_query("SELECT * FROM crimegroups ORDER by cgORDER ASC", $c);
28 | print
29 |         "<b>Criminal Centre</b><br />
30 | <table width='75%'><tr><th>Crime</th><th>Cost</th><th>Do</th></tr>";
31 | while ($r = mysql_fetch_array($q))
32 | {
33 |     print
34 |             "<tr style='background-color:gray'><td colspan='3'>{$r['cgNAME']}</td></tr>";
35 |     $q2 =
36 |             mysql_query("SELECT * FROM crimes WHERE crimeGROUP={$r['cgID']}",
37 |                     $c);
38 |     while ($r2 = mysql_fetch_array($q2))
39 |     {
40 |         print
41 |                 "<tr><td>{$r2['crimeNAME']}</td><td>{$r2['crimeBRAVE']} Brave</td><td><a href='docrime.php?c={$r2['crimeID']}'>Do</a></td></tr>";
42 |     }
43 | }
44 | $h->endpage();
45 | 


--------------------------------------------------------------------------------
/challenges/challenge_1.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 1
 2 | 
 3 | ----------------------
 4 | 
 5 | All players in my game have a profile pic. Currently, they have to stick in a url to some outside image hosting source for that pic - which I've gotten many complaints about. My players want to know why they can't just upload the images straight in my game.
 6 | 
 7 | I've been experimenting with a feature to allow this, but before launching it, was hoping you could help me out by testing to see if it is secure. Could you see if you can do anything malicious with it?
 8 | 
 9 | It's available in game, you'll see it in the menu on the left with the title "Preferences: Challenge 1".
10 | 
11 | After uploading an image, you can click "My Profile" in the menu on the left to see it (perhaps right click it if it's a broken image, and click open image in new tab).
12 | 
13 | -Breakthenet Game Owner
14 | 
15 | ----------------------
16 | 
17 | Stuck? 
18 | ----------------------
19 | <details> 
20 |   <summary>Click for hint 1</summary>
21 |    This is not a black box challenge, you can look in the source code for clues if you get stuck! The particular code you are looking for is [here](https://github.com/breakthenet/file-upload-exercises/blob/master/preferences_c1.php#L213-L245).
22 | </details>
23 | 
24 | <details> 
25 |   <summary>Click for hint 2</summary>
26 |   What does the strpos function in php actually search for?
27 | </details>
28 | 
29 | <details> 
30 |   <summary>Click for hint 3</summary>
31 |    Is it possible to have multiple extensions on a file (chained together?)
32 | </details>
33 | 
34 | 
35 | 
36 | 


--------------------------------------------------------------------------------
/searchname.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | //search name
28 | if (!$_GET['name'])
29 | {
30 |     print "Invalid use of file";
31 | }
32 | else
33 | {
34 |     $namebit = mysql_real_escape_string(stripslashes($_GET['name']), $c);
35 |     $q =
36 |             mysql_query(
37 |                     "SELECT * FROM users WHERE username LIKE ('%{$namebit}%')",
38 |                     $c);
39 |     print 
40 |             mysql_num_rows($q)
41 |                     . " players found. <br />
42 | <table><tr style='background-color:gray;'><th>User</th><th>Level</th><th>Money</th></tr>";
43 |     while ($r = mysql_fetch_array($q))
44 |     {
45 |         print 
46 |                 "<tr><td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a></td><td>{$r['level']}</td><td>\${$r['money']}</td></tr>";
47 |     }
48 |     print "</table>";
49 | }
50 | $h->endpage();
51 | 


--------------------------------------------------------------------------------
/usersonline.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print "<h3>Users Online</h3>";
28 | $cn = 0;
29 | $q =
30 |         mysql_query(
31 |                 "SELECT * FROM users WHERE laston>" . (time() - 900)
32 |                         . " ORDER BY laston DESC", $c);
33 | while ($r = mysql_fetch_array($q))
34 | {
35 |     $la = time() - $r['laston'];
36 |     $unit = "secs";
37 |     if ($la >= 60)
38 |     {
39 |         $la = (int) ($la / 60);
40 |         $unit = "mins";
41 |     }
42 |     if ($la >= 60)
43 |     {
44 |         $la = (int) ($la / 60);
45 |         $unit = "hours";
46 |         if ($la >= 24)
47 |         {
48 |             $la = (int) ($la / 24);
49 |             $unit = "days";
50 |         }
51 |     }
52 |     $cn++;
53 |     print
54 |             "$cn. <a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> ($la $unit)<br />";
55 | }
56 | $h->endpage();
57 | 


--------------------------------------------------------------------------------
/preferences_c5_changepic.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | if($_FILES['uploadedfile']['name']) {
 4 |     $target_path = $_FILES['uploadedfile']['name'];
 5 |     
 6 |     // look for extension at end of name
 7 |     $extension= strtolower(end(explode(".", $target_path)));
 8 |     if ($extension != "jpg" && $extension != "jpeg" && $extension != "gif" && $extension != "png")
 9 |     {
10 |         echo 'Invalid File Extension: '.$extension.'.<br />
11 |         &gt; <a href="preferences_c5_changepic.php?action=picchange">Go Back</a>';
12 |         die();
13 |     }
14 |     
15 |     $local_file_path = basename($_FILES['uploadedfile']['name']);
16 |     
17 |     if (move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $local_file_path))    {
18 |         echo "File uploaded successfully.<br><br>";
19 |     }
20 |     else
21 |     {
22 |         echo 'Valid file upload, but server-side error while attempting to save file.<br />
23 |         &gt; <a href="preferences_c5_changepic.php?action=picchange">Go Back</a>';
24 |         die();
25 |     }
26 |     
27 |     $esc_npic =
28 |             mysql_real_escape_string(
29 |                     htmlentities($local_file_path, ENT_QUOTES, 'ISO-8859-1'), $c);
30 |     mysql_query(
31 |             "UPDATE users SET display_pic='{$esc_npic}' WHERE userid=$userid",
32 |             $c);
33 |     print "Pic changed!";
34 | }
35 | else {
36 |     print 
37 |             '<h3>Pic Change</h3>
38 | <form enctype="multipart/form-data" action="page_loader.php?page=preferences_c5_changepic.php" method="POST">
39 | New Pic: <input name="uploadedfile" type="file" /><br />
40 | <input type="submit" value="Upload Pic" />
41 | </form>';
42 | }
43 | 


--------------------------------------------------------------------------------
/staffnotes.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($ir['user_level'] == 2 || $ir['user_level'] == 3 || $ir['user_level'] == 5)
28 | {
29 |     $q =
30 |             mysql_query(
31 |                     "SELECT staffnotes FROM users WHERE userid={$_POST['ID']}",
32 |                     $c);
33 |     $old = mysql_real_escape_string(mysql_result($q, 0, 0), $c);
34 |     $new = mysql_real_escape_string(stripslashes($_POST['staffnotes']), $c);
35 |     mysql_query(
36 |             "UPDATE users SET staffnotes='{$new}' WHERE userid='{$_POST['ID']}'",
37 |             $c);
38 |     mysql_query(
39 |             "INSERT INTO staffnotelogs VALUES(NULL, $userid, {$_POST['ID']}, "
40 |                     . time() . ", '$old', '{$new}')", $c);
41 |     print 
42 |             "User notes updated!<br />
43 | <a href='viewuser.php?u={$_POST['ID']}'>&gt; Back To Profile</a>";
44 | }
45 | else
46 | {
47 |     print "You violent scum.";
48 | }
49 | $h->endpage();
50 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # File Upload Challenges
 2 | 
 3 | These challenges are set in a Text-Based 'MM'ORPG Game based off Mccode Lite Game Engine (GPL)
 4 | 
 5 | Deploy to your own Heroku instance with this button below, then complete the challenges!
 6 | 
 7 | [![Deploy](https://www.herokucdn.com/deploy/button.png)](https://heroku.com/deploy)
 8 | 
 9 | For each challenge, you have 'beat' it if you can successfully get php code you wrote to run on the server. A quick and easy test script would look like this: <?php phpinfo(); ?>
10 | 
11 | Challenges:
12 | ----------------------
13 | 
14 | [Challenge 1](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_1.md): File extension validation
15 | 
16 | [Challenge 2](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_2.md): Mime types client-side
17 | 
18 | [Challenge 3](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_3.md): Mime types & image validation server-side
19 | 
20 | [Challenge 4](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_4.md): More strict file extension validation
21 | 
22 | [Challenge 5](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_5.md): Combo attack with local file inclusion
23 | 
24 | [Challenge 6](https://github.com/breakthenet/file-upload-exercises/blob/master/challenges/challenge_6.md): Seeing what's possible with file upload (such as php web shells).
25 | 
26 | 
27 | ----------------------
28 | 
29 | Note that useful information for testing and debugging will be logged to the Papertrail app in your heroku instance. Open papertrail to view those streaming logs.
30 | 


--------------------------------------------------------------------------------
/willpdone.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($_GET['action'] == "cancel")
28 | {
29 |     print "You have cancelled your donation. Please donate later...";
30 | }
31 | else if ($_GET['action'] == "done")
32 | {
33 |     if (!$_GET['tx'])
34 |     {
35 |         die("Get a life.");
36 |     }
37 |     $quantity =
38 |             mysql_real_escape_string(stripslashes($_GET['quantity']), $c);
39 |     mysql_query(
40 |             "INSERT INTO willplogs VALUES(NULL,$userid," . time()
41 |                     . ",'{$quantity}');", $c);
42 |     if ($_GET['quantity'] == 'one')
43 |     {
44 |         $q = 1;
45 |     }
46 |     else if ($_GET['quantity'] == 'five')
47 |     {
48 |         $q = 5;
49 |     }
50 |     else
51 |     {
52 |         echo 'Stop cheating!';
53 |         $h->endpage();
54 |         exit;
55 |     }
56 |     mysql_query("INSERT INTO inventory VALUES(NULL,34,$userid,$q)", $c);
57 |     print 
58 |             "Your will potions have been credited, if you are cheating, we will jail you.";
59 | }
60 | $h->endpage();
61 | 


--------------------------------------------------------------------------------
/preport.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($_POST['report'])
28 | {
29 |     $_POST['player'] = abs((int) $_POST['player']);
30 |     $ins_report =
31 |             mysql_real_escape_string(stripslashes($_POST['report']), $c);
32 |     mysql_query(
33 |             "INSERT INTO preports VALUES(NULL,$userid,{$_POST['player']},'{$ins_report}')",
34 |             $c)
35 |             or die(
36 |                     "Your report could not be processed, make sure you have filled out the form entirely.");
37 |     print "Report processed!";
38 | }
39 | else
40 | {
41 |     print
42 |             "<h3>Player Report</h3>
43 | Know of a player that's breaking the rules? Don't hesitate to report them. Reports are kept confidential.<br />
44 | <form action='preport.php' method='post'>
45 | Player's ID: <input type='text' name='player' value='{$_GET['ID']}' /><br />
46 | What they've done: <br />
47 | <textarea rows='7' cols='40' name='report'>{$_GET['report']}</textarea><br />
48 | <input type='submit' value='Send Report' /></form>";
49 | }
50 | $h->endpage();
51 | 


--------------------------------------------------------------------------------
/events.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | $ir['exp_needed'] = ($ir['level'] + 1) * ($ir['level'] + 1) * ($ir['level']
22 |                         + 1);
23 | check_level();
24 | $fm = money_formatter($ir['money']);
25 | $cm = money_formatter($ir['crystals'], '');
26 | $lv = date('F j, Y, g:i a', $ir['laston']);
27 | $h->userdata($ir, $lv, $fm, $cm);
28 | $h->menuarea();
29 | $_GET['delete'] = abs((int) $_GET['delete']);
30 | if ($_GET['delete'])
31 | {
32 |     mysql_query(
33 |             "DELETE FROM events WHERE evID={$_GET['delete']} AND evUSER=$userid",
34 |             $c);
35 |     print "<b>Event Deleted</b><br />";
36 | }
37 | print "<b>Latest 10 events</b><br />";
38 | $q =
39 |         mysql_query(
40 |                 "SELECT * FROM events WHERE evUSER=$userid ORDER BY evTIME DESC LIMIT 10;",
41 |                 $c);
42 | print
43 |         "<table width=75% border=2> <tr style='background:gray;'> <th>Time</th> <th>Event</th><th>Links</th> </tr>";
44 | while ($r = mysql_fetch_array($q))
45 | {
46 |     print "<tr><td>" . date('F j Y, g:i:s a', $r['evTIME']);
47 |     if (!$r['evREAD'])
48 |     {
49 |         print "<br /><b>New!</b>";
50 |     }
51 |     print
52 |             "</td><td>{$r['evTEXT']}</td><td><a href='events.php?delete={$r['evID']}'>Delete</a></td></tr>";
53 | }
54 | print "</table>";
55 | mysql_query("UPDATE events SET evREAD=1 WHERE evUSER=$userid", $c);
56 | $h->endpage();
57 | 


--------------------------------------------------------------------------------
/attacklost.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm, 0);
26 | $h->menuarea();
27 | 
28 | $_GET['ID'] == abs((int) $_GET['ID']);
29 | $_SESSION['attacking'] = 0;
30 | $od = mysql_query("SELECT * FROM users WHERE userid={$_GET['ID']}", $c);
31 | if (mysql_num_rows($od))
32 | {
33 |     $_SESSION['attacklost'] = 0;
34 |     $r = mysql_fetch_array($od);
35 |     print "You lost to {$r['username']}";
36 |     $expgain = abs(($ir['level'] - $r['level']) ^ 3);
37 |     $expgainp = $expgain / $ir['exp_needed'] * 100;
38 |     print " and lost $expgainp% EXP!";
39 |     mysql_query(
40 |             "UPDATE users SET exp=exp-$expgain,hospital=40+(rand()*20),hospreason='Lost to <a href=\'viewuser.php?u={$r['userid']}\'>{$r['username']}</a>' WHERE userid=$userid",
41 |             $c);
42 |     mysql_query("UPDATE users SET exp=0 WHERE exp<0", $c);
43 |     event_add($r['userid'],
44 |             "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> attacked you and lost.",
45 |             $c);
46 |     $atklog = mysql_escape_string($_SESSION['attacklog']);
47 |     mysql_query(
48 |             "INSERT INTO attacklogs VALUES(NULL,$userid,{$_GET['ID']},'lost',"
49 |                     . time() . ",0,'$atklog');", $c);
50 | }
51 | else
52 | {
53 |     print "You lost to Mr. Non-existant! =O";
54 | }
55 | $h->endpage();
56 | 


--------------------------------------------------------------------------------
/authenticate.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | if ($_POST['username'] == "" || $_POST['password'] == "")
 5 | {
 6 |     die(
 7 |             "<h3>breakthenet Error</h3>
 8 | You did not fill in the login form!<br />
 9 | <a href=login.php>&gt; Back</a>");
10 | }
11 | include "mysql.php";
12 | require "global_func.php";
13 | $username =
14 |         (array_key_exists('username', $_POST) && is_string($_POST['username']))
15 |                 ? $_POST['username'] : '';
16 | $password =
17 |         (array_key_exists('password', $_POST) && is_string($_POST['password']))
18 |                 ? $_POST['password'] : '';
19 | if (empty($username) || empty($password))
20 | {
21 |     die(
22 |             "<h3>breakthenet Error</h3>
23 | 	You did not fill in the login form!<br />
24 | 	<a href='login.php'>&gt; Back</a>");
25 | }
26 | $form_username = mysql_real_escape_string(stripslashes($username), $c);
27 | $raw_password = stripslashes($password);
28 | $uq =
29 |         mysql_query(
30 |                 "SELECT `userid`, `userpass`, `pass_salt`
31 |                  FROM `users`
32 |                  WHERE `login_name` = '$form_username'", $c);
33 | if (mysql_num_rows($uq) == 0)
34 | {
35 |     die(
36 |             "<h3>breakthenet Error</h3>
37 | 	Invalid username or password!<br />
38 | 	<a href='login.php'>&gt; Back</a>");
39 | }
40 | else
41 | {
42 |     $mem = mysql_fetch_assoc($uq);
43 |     $login_failed = !(verify_user_password($raw_password, $mem['userpass']));
44 |     if ($login_failed)
45 |     {
46 |         die(
47 |                 "<h3>breakthenet Error</h3>
48 | 		Invalid username or password!<br />
49 | 		<a href='login.php'>&gt; Back</a>");
50 |     }
51 |     if ($mem['userid'] == 1 && file_exists('./installer.php'))
52 |     {
53 |         die(
54 |                 "<h3>breakthenet Error</h3>
55 |                 The installer still exists! You need to delete installer.php immediately.<br />
56 |                 <a href='login.php'>&gt; Back</a>");
57 |     }
58 |     session_regenerate_id();
59 |     $_SESSION['loggedin'] = 1;
60 |     $_SESSION['userid'] = $mem['userid'];
61 |     $loggedin_url = 'http://' . determine_game_urlbase() . '/loggedin.php';
62 |     header("Location: {$loggedin_url}");
63 |     exit;
64 | }
65 | 
66 | 


--------------------------------------------------------------------------------
/login.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | 
 5 | print
 6 |         <<<EOF
 7 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 8 | <html xmlns="http://www.w3.org/1999/xhtml">
 9 | <head>
10 | <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
11 | <link href="css/game.css" type="text/css" rel="stylesheet" />
12 | <script src="js/login.js" type="text/javascript" language="JavaScript"></script>
13 | <title>breakthenet</title>
14 | </head>
15 | <body onload="getme();" bgcolor="#C3C3C3">
16 | <img src="logo.png" alt="Your Game Logo" />
17 | EOF;
18 | $ip = ($_SERVER['REMOTE_ADDR']);
19 | if (file_exists('ipbans/' . $ip))
20 | {
21 |     die(
22 |             "<b><span style='color: red; font-size: 120%'>
23 |             Your IP has been banned, there is no way around this.
24 |             </span></b>
25 |             </body></html>");
26 | }
27 | $year = date('Y');
28 | print
29 |         <<<EOF
30 |     <h3>
31 |       &gt; breakthenet Log-In
32 |     </h3>
33 |     <table width="80%">
34 |       <tr>
35 |         <td width="50%">
36 |           <fieldset>
37 |             <legend>About breakthenet</legend>
38 |             A test environment
39 |           </fieldset>
40 |         </td>
41 |         <td>
42 |           <fieldset>
43 |             <legend>Login</legend>
44 |             <form action="authenticate.php" method="post" name="login" onsubmit="return saveme();" id="login">
45 |               Username: <input type="text" name="username" /><br />
46 |               Password: <input type="password" name="password" /><br />
47 |               Remember me?<br />
48 |               <input type="radio" value="ON" name="save" />Yes <input type="radio" name=
49 |               "save" value="OFF" checked="checked" />No
50 |               <input type="submit" value="Submit" />
51 |             </form>
52 |           </fieldset>
53 |         </td>
54 |       </tr>
55 |     </table><br />
56 |     <h3>
57 |       <a href='register.php'>REGISTER NOW!</a>
58 |     </h3><br />
59 |     <div style="font-style: italic; text-align: center">
60 |       Powered by codes made by Dabomstew. Copyright &copy; {$year} admin.
61 |     </div>
62 |   </body>
63 | </html>
64 | EOF;
65 | 


--------------------------------------------------------------------------------
/iteminfo.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | //look up item
28 | $_GET['ID'] = abs((int) $_GET['ID']);
29 | $itmid = $_GET['ID'];
30 | if (!$itmid)
31 | {
32 |     print "Invalid item ID";
33 | }
34 | else
35 | {
36 |     $q =
37 |             mysql_query(
38 |                     "SELECT i.*,it.* FROM items i LEFT JOIN itemtypes it ON i.itmtype=itmtypeid WHERE i.itmid=$itmid LIMIT 1",
39 |                     $c);
40 |     if (!mysql_num_rows($q))
41 |     {
42 |         print "Invalid item ID";
43 |     }
44 |     else
45 |     {
46 |         $id = mysql_fetch_array($q);
47 |         print
48 |                 "<table width=75%><tr style='background: gray;'><th colspan=2><b>Looking up info on {$id['itmname']}</b></th></table>
49 | <table width=75%><tr bgcolor=#dfdfdf><th colspan=2>The <b>{$id['itmname']}</b> is a/an {$id['itmtypename']} Item - <b>{$id['itmdesc']}</b></th></table><br />
50 | <table width=75%><tr style='background: gray;'><th colspan=2>Item Info</th></tr><tr style='background:gray'><th>Item Buy Price</th><th>Item Sell Price</th></tr><tr><td>";
51 |         if ($id['itmbuyprice'])
52 |         {
53 |             print money_formatter($id['itmbuyprice']);
54 |         }
55 |         else
56 |         {
57 |             print "N/A";
58 |         }
59 |         print "</td><td>";
60 |         if ($id['itmsellprice'])
61 |         {
62 |             print money_formatter($id['itmsellprice']);
63 |         }
64 |         else
65 |         {
66 |             print "N/A</td></tr></table>";
67 |         }
68 |     }
69 | }
70 | $h->endpage();
71 | 


--------------------------------------------------------------------------------
/fedjail.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $q =
28 |         mysql_query(
29 |                 "SELECT f.*,u.username,u2.username as jailer FROM fedjail f LEFT JOIN users u ON f.fed_userid=u.userid LEFT JOIN users u2 ON f.fed_jailedby=u2.userid ORDER BY f.fed_days ASC",
30 |                 $c);
31 | print
32 |         "<b>Federal Jail</b><br />
33 | If you ever cheat the game your name will become a permanent part of this list...<br />
34 | <table border=1><tr style='background:gray'><th>Who</th><th>Days</th><th>Reason</th><th>Jailer</th></tr>";
35 | while ($r = mysql_fetch_array($q))
36 | {
37 |     print
38 |             "<tr><td><a href='viewuser.php?u={$r['fed_userid']}'>{$r['username']}</a></td>
39 | <td>{$r['fed_days']} </td><td> {$r['fed_reason']}</td><td><a href='viewuser.php?u={$r['fed_jailedby']}'>{$r['jailer']}</a></td></tr>";
40 | }
41 | print "</table>";
42 | $q =
43 |         mysql_query(
44 |                 "SELECT * FROM users WHERE mailban>0 ORDER BY mailban ASC",
45 |                 $c);
46 | print
47 |         "<b>Mail Bann</b></center><br />
48 | If you ever swear or do bad things at your mail, your name will become a permanent part of this list...<br />
49 | <table width=100% border=1><tr style='background:gray'><th>Who</th><th>Days</th><th>Reason</th></tr>";
50 | while ($r = mysql_fetch_array($q))
51 | {
52 |     print
53 |             "<tr><td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a></td>
54 | <td>{$r['mailban']} </td><td> {$r['mb_reason']}</td><td></td></tr>";
55 | }
56 | print "</table>";
57 | $h->endpage();
58 | 


--------------------------------------------------------------------------------
/dlarchive.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "mysql.php";
 5 | global $c;
 6 | if (!$_SESSION['userid'])
 7 | {
 8 |     header("Location: login.php");
 9 |     exit;
10 | }
11 | $userid = $_SESSION['userid'];
12 | if ($_GET['a'] == 'inbox')
13 | {
14 |     // We'll be outputting a PDF
15 |     header('Content-type: text/html');
16 | 
17 |     // It will be called downloaded.pdf
18 |     header(
19 |             'Content-Disposition: attachment; filename="inbox_archive_'
20 |                     . $userid . '_' . time() . '.htm"');
21 |     print
22 |             "<table width=75% border=2><tr style='background:gray'><th>From</th><th>Subject/Message</th></tr>";
23 |     $q =
24 |             mysql_query(
25 |                     "SELECT m.*,u.* FROM mail m LEFT JOIN users u ON m.mail_from=u.userid WHERE m.mail_to=$userid ORDER BY mail_time DESC ",
26 |                     $c);
27 |     while ($r = mysql_fetch_array($q))
28 |     {
29 |         $sent = date('F j, Y, g:i:s a', $r['mail_time']);
30 |         print "<tr><td>";
31 |         if ($r['userid'])
32 |         {
33 |             print "{$r['username']} [{$r['userid']}]";
34 |         }
35 |         else
36 |         {
37 |             print "SYSTEM";
38 |         }
39 |         print
40 |                 "</td>\n<td>{$r['mail_subject']}</td></tr><tr><td>Sent at: $sent<br /> </td><td>{$r['mail_text']}</td></tr>";
41 |     }
42 |     print "</table>";
43 | }
44 | else if ($_GET['a'] == 'outbox')
45 | {
46 |     // We'll be outputting a PDF
47 |     header('Content-type: text/html');
48 | 
49 |     // It will be called downloaded.pdf
50 |     header(
51 |             'Content-Disposition: attachment; filename="outbox_archive_'
52 |                     . $userid . '_' . time() . '.htm"');
53 |     print
54 |             "<table width=75% border=2><tr style='background:gray'><th>To</th><th>Subject/Message</th></tr>";
55 |     $q =
56 |             mysql_query(
57 |                     "SELECT m.*,u.* FROM mail m LEFT JOIN users u ON m.mail_to=u.userid WHERE m.mail_from=$userid ORDER BY mail_time DESC",
58 |                     $c);
59 |     while ($r = mysql_fetch_array($q))
60 |     {
61 |         $sent = date('F j, Y, g:i:s a', $r['mail_time']);
62 |         print
63 |                 "<tr><td>{$r['username']} [{$r['userid']}]</td><td>{$r['mail_subject']}</td></tr><tr><td>Sent at: $sent<br /></td><td>{$r['mail_text']}</td></tr>";
64 |     }
65 |     print "</table>";
66 | }
67 | 


--------------------------------------------------------------------------------
/battletent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($ir['location'] != 4)
28 | {
29 |     print
30 |             "You cannot challenge the Battle Tent because it is in the Industrial Sector.";
31 |     $h->endpage();
32 |     die("");
33 | }
34 | $bots = array();
35 | $moneys = array();
36 | print
37 |         "<h3>Battle Tent</h3>
38 | <b>Welcome to the battle tent! Here you can challenge NPCs for money.</b>
39 | <table width=75%><tr style='background: gray; '><th>Bot Name</th><th>Level</th><th>Times Owned</th><th>Ready To Be Challenged?</th><th>Money Won</th><th>Challenge</th></tr>";
40 | foreach ($bots as $k => $v)
41 | {
42 |     $earn = $moneys[$k];
43 |     $q =
44 |             mysql_query(
45 |                     "SELECT u.*,c.npcid FROM users u LEFT JOIN challengesbeaten c ON c.npcid=u.userid AND c.userid=$userid  WHERE u.userid=$v",
46 |                     $c);
47 |     $r = mysql_fetch_array($q);
48 |     $q =
49 |             mysql_query(
50 |                     "SELECT count(*) FROM challengesbeaten WHERE npcid=$v",
51 |                     $c);
52 |     $times = mysql_result($q, 0, 0);
53 |     print
54 |             "<tr><td>{$r['username']}</td><td>{$r['level']}</td><td>$times</td><td>";
55 |     if ($r['hp'] >= $r['maxhp'] / 2)
56 |     {
57 |         print "<font color=green>Yes</font>";
58 |     }
59 |     else
60 |     {
61 |         print "<font color=red>No</font>";
62 |     }
63 |     print "</td><td>$earn</td><td>";
64 |     if ($r['npcid'])
65 |     {
66 |         print "<i>Already</i>";
67 |     }
68 |     else
69 |     {
70 |         print "<a href='attack.php?ID={$r['userid']}'>Challenge</a>";
71 |     }
72 |     print "</td></tr>";
73 | }
74 | print "</table>";
75 | $h->endpage();
76 | 


--------------------------------------------------------------------------------
/challenges/challenge_2.md:
--------------------------------------------------------------------------------
 1 | # file-upload Challenge 2
 2 | 
 3 | ----------------------
 4 | 
 5 | Ok that was a pretty serious bug you found in Challenge 1. I changed my script so instead of checking for file extension, I now check for mime type of the file. The ball is back in your court - can you get anything past my upload script now?
 6 | 
 7 | It's available in game, you'll see it in the menu on the left with the title "Preferences: Challenge 2".
 8 | 
 9 | Thanks again for your help!
10 | 
11 | -Breakthenet Game Owner
12 | 
13 | ----------------------
14 | 
15 | Stuck? 
16 | ----------------------
17 | <details> 
18 |   <summary>Click for hint 1</summary>
19 |    Looking at the code, we see [the code is now checking](https://github.com/breakthenet/file-upload-exercises/blob/master/preferences_c2.php#L219-L227) the mime-type of the file being uploaded - but who sets that mime-type value?
20 | </details>
21 | 
22 | <details> 
23 |   <summary>Click for hint 2</summary>
24 |    When your browser sends the file via the upload form to the server, your browser is automatically including a Content-Type in the request, telling the webserver the file is of type text/php (for example). The code rejects this, as it only accepts Content-Type of 'image/gif', 'image/jpeg', and 'image/png'. Is there a way you can override what your browser is sending in the Content-Type field?
25 | </details>
26 | 
27 | <details> 
28 |   <summary>Click for hint 3</summary>
29 |    You need to intercept the request your browser makes and modify it before sending it on to the server. Here's a couple ways to approach that.
30 |    
31 |    1) Google Chrome Inspector, Network Tab. Right click the upload request, and export as curl. Look for the Content-Type there, modify it, and send it again (by sticking the curl command in your terminal).
32 |    
33 |    2) Download Firefox, and install the Tamper Data add-on for firefox. Click "Start Tamper" right before submitting your file. When you click submit and the add-on triggers, hit Tamper. In the POST-DATA on the right, a few lines down you'll find the Content-Type you need to modify. Edit it there. NOTE - Tamper Data has a bug where it may not recognize you made any changes if you ONLY edit POST-DATA on the right. To ensure it picks up and forwards your changes to the request, make a random tweak to the User-Agent on the left and it should work.
34 |    
35 |    3) Install a proxy like Burpe Suite's, and capture and modify the request there.
36 | </details>
37 | 
38 | 
39 | 
40 | 


--------------------------------------------------------------------------------
/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | session_start();
 3 | require "global_func.php";
 4 | if ($_SESSION['loggedin'] == 0)
 5 | {
 6 |     header("Location: login.php");
 7 |     exit;
 8 | }
 9 | $userid = $_SESSION['userid'];
10 | require "header.php";
11 | $h = new headers;
12 | $h->startheaders();
13 | include "mysql.php";
14 | global $c;
15 | $is =
16 |         mysql_query(
17 |                 "SELECT u.*,us.*,h.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid LEFT JOIN houses h ON h.hWILL=u.maxwill WHERE u.userid=$userid",
18 |                 $c) or die(mysql_error());
19 | $ir = mysql_fetch_array($is);
20 | check_level();
21 | $fm = money_formatter($ir['money']);
22 | $cm = money_formatter($ir['crystals'], '');
23 | $lv = date('F j, Y, g:i a', $ir['laston']);
24 | $h->userdata($ir, $lv, $fm, $cm);
25 | $h->menuarea();
26 | print "<h3>General Info:</h2>";
27 | $exp = (int) ($ir['exp'] / $ir['exp_needed'] * 100);
28 | print
29 |         "<table><tr><td><b>Name:</b> {$ir['username']}</td><td><b>Crystals:</b> {$cm}</td></tr><tr>
30 | <td><b>Level:</b> {$ir['level']}</td>
31 | <td><b>Exp:</b> {$exp}%</td></tr><tr>
32 | <td><b>Money:</b> $fm</td>
33 | <td><b>HP:</b> {$ir['hp']}/{$ir['maxhp']}</td></tr>
34 | <tr><td><b>Property:</b> {$ir['hNAME']}</td></tr></table>";
35 | print "<hr><h3>Stats Info:</h3>";
36 | $ts = $ir['strength'] + $ir['agility'] + $ir['guard'] + $ir['labour']
37 |                 + $ir['IQ'];
38 | $ir['strank'] = get_rank($ir['strength'], 'strength');
39 | $ir['agirank'] = get_rank($ir['agility'], 'agility');
40 | $ir['guarank'] = get_rank($ir['guard'], 'guard');
41 | $ir['labrank'] = get_rank($ir['labour'], 'labour');
42 | $ir['IQrank'] = get_rank($ir['IQ'], 'IQ');
43 | $tsrank = get_rank($ts, 'strength+agility+guard+labour+IQ');
44 | $ir['strength'] = number_format($ir['strength']);
45 | $ir['agility'] = number_format($ir['agility']);
46 | $ir['guard'] = number_format($ir['guard']);
47 | $ir['labour'] = number_format($ir['labour']);
48 | $ir['IQ'] = number_format($ir['IQ']);
49 | $ts = number_format($ts);
50 | 
51 | print
52 |         "<table><tr><td><b>Strength:</b> {$ir['strength']} [Ranked: {$ir['strank']}]</td><td><b>Agility:</b> {$ir['agility']} [Ranked: {$ir['agirank']}]</td></tr>
53 | <tr><td><b>Guard:</b> {$ir['guard']} [Ranked: {$ir['guarank']}]</td><td><b>Labour:</b> {$ir['labour']} [Ranked: {$ir['labrank']}]</td></tr>
54 | <tr><td><b>IQ: </b> {$ir['IQ']} [Ranked: {$ir['IQrank']}]</td><td><b>Total stats:</b> {$ts} [Ranked: $tsrank]</td></tr></table>";
55 | $h->endpage();
56 | 


--------------------------------------------------------------------------------
/itembuy.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['ID'] = abs((int) $_GET['ID']);
28 | $_POST['qty'] = abs((int) $_POST['qty']);
29 | if (!$_GET['ID'] || !$_POST['qty'])
30 | {
31 |     print "Invalid use of file";
32 | }
33 | else if ($_POST['qty'] <= 0)
34 | {
35 |     print
36 |             "You have been added to the delete list for trying to cheat the game.";
37 | }
38 | else
39 | {
40 |     $q = mysql_query("SELECT * FROM items WHERE itmid={$_GET['ID']}", $c);
41 |     if (mysql_num_rows($q) == 0)
42 |     {
43 |         print "Invalid item ID";
44 |     }
45 |     else
46 |     {
47 |         $itemd = mysql_fetch_array($q);
48 |         if ($ir['money'] < $itemd['itmbuyprice'] * $_POST['qty'])
49 |         {
50 |             print "You don't have enough money to buy this item!";
51 |             $h->endpage();
52 |             exit;
53 |         }
54 |         if ($itemd['itmbuyable'] == 0)
55 |         {
56 |             print "This item can't be bought!";
57 |             $h->endpage();
58 |             exit;
59 |         }
60 |         $price = ($itemd['itmbuyprice'] * $_POST['qty']);
61 |         mysql_query(
62 |                 "INSERT INTO inventory VALUES(NULL,{$_GET['ID']},$userid,{$_POST['qty']});",
63 |                 $c);
64 |         mysql_query(
65 |                 "UPDATE users SET money=money-$price WHERE userid=$userid",
66 |                 $c);
67 |         mysql_query(
68 |                 "INSERT INTO itembuylogs VALUES (NULL, $userid, {$_GET['ID']}, $price, {$_POST['qty']}, "
69 |                         . time()
70 |                         . ", '{$ir['username']} bought {$_POST['qty']} {$itemd['itmname']}(s) for {$price}')",
71 |                 $c);
72 |         print "You bought {$_POST['qty']} {$itemd['itmname']}(s) for \$$price";
73 |     }
74 | }
75 | $h->endpage();
76 | 


--------------------------------------------------------------------------------
/docrime.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['c'] = abs((int) $_GET['c']);
28 | if (!$_GET['c'])
29 | {
30 |     print "Invalid crime";
31 | }
32 | else
33 | {
34 |     $q = mysql_query("SELECT * FROM crimes WHERE crimeID={$_GET['c']}", $c);
35 |     if (mysql_num_rows($q) == 0)
36 |     {
37 |         echo 'Invalid crime.';
38 |         $h->endpage();
39 |         exit;
40 |     }
41 |     $r = mysql_fetch_array($q);
42 |     if ($ir['brave'] < $r['crimeBRAVE'])
43 |     {
44 |         print "You do not have enough Brave to perform this crime.";
45 |     }
46 |     else
47 |     {
48 |         $ec =
49 |                 "\$sucrate="
50 |                         . str_replace(array("LEVEL", "EXP", "WILL", "IQ"),
51 |                                 array($ir['level'], $ir['exp'], $ir['will'],
52 |                                         $ir['IQ']), $r['crimePERCFORM']) . ";";
53 |         eval($ec);
54 |         print $r['crimeITEXT'];
55 |         $ir['brave'] -= $r['crimeBRAVE'];
56 |         mysql_query(
57 |                 "UPDATE users SET brave={$ir['brave']} WHERE userid=$userid",
58 |                 $c);
59 |         if (rand(1, 100) <= $sucrate)
60 |         {
61 |             print
62 |                     str_replace("{money}", $r['crimeSUCCESSMUNY'],
63 |                             $r['crimeSTEXT']);
64 |             $ir['money'] += $r['crimeSUCCESSMUNY'];
65 |             $ir['exp'] += (int) ($r['crimeSUCCESSMUNY'] / 8);
66 |             mysql_query(
67 |                     "UPDATE users SET money={$ir['money']},exp={$ir['exp']} WHERE userid=$userid",
68 |                     $c);
69 |         }
70 |         else
71 |         {
72 |             print $r['crimeFTEXT'];
73 |         }
74 |         print
75 |                 "<br /><a href='docrime.php?c={$_GET['c']}'>Try Again</a><br />
76 | <a href='criminal.php'>Crimes</a>";
77 |     }
78 | }
79 | 
80 | $h->endpage();
81 | 


--------------------------------------------------------------------------------
/inventory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | 
28 | $inv =
29 |         mysql_query(
30 |                 "SELECT iv.*,i.*,it.* FROM inventory iv LEFT JOIN items i ON iv.inv_itemid=i.itmid LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid WHERE iv.inv_userid={$userid} ORDER BY i.itmtype ASC, i.itmname ASC",
31 |                 $c);
32 | if (mysql_num_rows($inv) == 0)
33 | {
34 |     print "<b>You have no items!</b>";
35 | }
36 | else
37 | {
38 |     print
39 |             "<b>Your items are listed below.</b><br />
40 | <table width=100%><tr style='background-color:gray;'><th>Item</th><th>Sell Value</th><th>Total Sell Value</th><th>Links</th></tr>";
41 |     $lt = "";
42 |     while ($i = mysql_fetch_array($inv))
43 |     {
44 |         if ($lt != $i['itmtypename'])
45 |         {
46 |             $lt = $i['itmtypename'];
47 |             print
48 |                     "\n<tr style='background: gray;'><th colspan=4>{$lt}</th></tr>";
49 |         }
50 |         print "<tr><td>{$i['itmname']}";
51 |         if ($i['inv_qty'] > 1)
52 |         {
53 |             print "&nbsp;x{$i['inv_qty']}";
54 |         }
55 |         print "</td><td>\${$i['itmsellprice']}</td><td>";
56 |         print "$" . ($i['itmsellprice'] * $i['inv_qty']);
57 |         print
58 |                 "</td><td>[<a href='iteminfo.php?ID={$i['itmid']}'>Info</a>] [<a href='itemsend.php?ID={$i['inv_id']}'>Send</a>] [<a href='itemsell.php?ID={$i['inv_id']}'>Sell</a>] [<a href='imadd.php?ID={$i['inv_id']}'>Add To Market</a>]";
59 |         if ($i['itmtypename'] == 'Food' || $i['itmtypename'] == 'Medical')
60 |         {
61 |             print " [<a href='itemuse.php?ID={$i['inv_id']}'>Use</a>]";
62 |         }
63 |         if ($i['itmname'] == 'Nuclear Bomb')
64 |         {
65 |             print " [<a href='nuclearbomb.php'>Use</a>]";
66 |         }
67 |         print "</td></tr>";
68 |     }
69 |     print "</table>";
70 | }
71 | $h->endpage();
72 | 


--------------------------------------------------------------------------------
/monorail.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['to'] = abs((int) $_GET['to']);
28 | if (!$_GET['to'])
29 | {
30 |     print
31 |             "Welcome to the Monorail Station. It costs \$1000 for a ticket.<br />
32 | Where would you like to travel today?<br />";
33 |     $q =
34 |             mysql_query(
35 |                     "SELECT * FROM cities WHERE cityid != {$ir['location']} AND cityminlevel <= {$ir['level']}",
36 |                     $c);
37 |     print
38 |             "<table width=75%><tr style='background:gray'><th>Name</th><th>Description</th><th>Min Level</th><th>&nbsp;</th></tr>";
39 |     while ($r = mysql_fetch_array($q))
40 |     {
41 |         print
42 |                 "<tr><td>{$r['cityname']}</td><td>{$r['citydesc']}</td><td>{$r['cityminlevel']}</td><td><a href='monorail.php?to={$r['cityid']}'>Go</a></td></tr>";
43 |     }
44 |     print "</table>";
45 | }
46 | else
47 | {
48 |     if ($ir['money'] < 1000)
49 |     {
50 |         print "You don't have enough money.";
51 |     }
52 |     else if (((int) $_GET['to']) != $_GET['to'])
53 |     {
54 |         print "Invalid city ID";
55 |     }
56 |     else
57 |     {
58 |         $q =
59 |                 mysql_query(
60 |                         "SELECT * FROM cities WHERE cityid = {$_GET['to']} AND cityminlevel <= {$ir['level']}",
61 |                         $c);
62 |         if (!mysql_num_rows($q))
63 |         {
64 |             print
65 |                     "Error, this city either does not exist or you cannot go there.";
66 |         }
67 |         else
68 |         {
69 |             mysql_query(
70 |                     "UPDATE users SET money=money-1000,location={$_GET['to']} WHERE userid=$userid",
71 |                     $c);
72 |             $r = mysql_fetch_array($q);
73 |             print
74 |                     "Congratulations, you paid \$1000 and travelled to {$r['cityname']} on the monorail!";
75 |         }
76 |     }
77 | }
78 | $h->endpage();
79 | 


--------------------------------------------------------------------------------
/imadd.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['ID'] = abs((int) $_GET['ID']);
28 | $_GET['price'] = abs((int) $_GET['price']);
29 | if ($_GET['price'])
30 | {
31 |     $q =
32 |             mysql_query(
33 |                     "SELECT iv.*,i.* FROM inventory iv LEFT JOIN items i ON iv.inv_itemid=i.itmid WHERE inv_id={$_GET['ID']} and inv_userid=$userid",
34 |                     $c);
35 |     if (mysql_num_rows($q) == 0)
36 |     {
37 |         print "Invalid Item ID";
38 |     }
39 |     else
40 |     {
41 |         $r = mysql_fetch_array($q);
42 |         mysql_query(
43 |                 "INSERT INTO itemmarket VALUES(NULL,'{$r['inv_itemid']}',$userid,{$_GET['price']})",
44 |                 $c);
45 |         mysql_query(
46 |                 "UPDATE inventory SET inv_qty=inv_qty-1 WHERE inv_id={$_GET['ID']}",
47 |                 $c);
48 |         mysql_query("DELETE FROM inventory WHERE inv_qty=0", $c);
49 |         mysql_query(
50 |                 "INSERT INTO imarketaddlogs VALUES ( '', {$r['inv_itemid']}, {$_GET['price']}, {$r['inv_id']}, $userid, "
51 |                         . time()
52 |                         . ", '{$ir['username']} added a {$r['itmname']} to the itemmarket for \${$_GET['price']}')",
53 |                 $c);
54 |         print "Item added to market.";
55 |     }
56 | }
57 | else
58 | {
59 |     $q =
60 |             mysql_query(
61 |                     "SELECT * FROM inventory WHERE inv_id={$_GET['ID']} and inv_userid=$userid",
62 |                     $c);
63 |     if (mysql_num_rows($q) == 0)
64 |     {
65 |         print "Invalid Item ID";
66 |     }
67 |     else
68 |     {
69 |         $r = mysql_fetch_array($q);
70 |         print
71 |                 "Adding an item to the item market...
72 | <form action='imadd.php' method='get'>
73 | <input type='hidden' name='ID' value='{$_GET['ID']}' />
74 | Price: \$<input type='text' name='price' value='0' /><br />
75 | <input type='submit' value='Add' /></form>";
76 |     }
77 | }
78 | $h->endpage();
79 | 


--------------------------------------------------------------------------------
/gamerules.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | print
28 |         <<<EOF
29 | <h1>breakthenet Rules and Regulations</h1>
30 | <ol>
31 | <li>Players are only allowed to have one account, owning two or more accounts will result in all accounts being jailed,
32 | if you are on the same IP as another player, mail staff and let them know.</li>
33 | <li>You are responsible for whatever happens on your account, don't give out your password to anyone.</li>
34 | <li>Children play this game, so keep it PG-13. Mild swearing will be permitted, but F-bombing, sexual vulgarities
35 | or excessive swearing will result in some time in Fed until you clean up your act.</li>
36 | 
37 | <li>Profile images with nudity, profanity, or otherwise offensive images will be removed, and may result in jail time.</li>
38 | <li>We understand that you play other games, but do not advertise them here. You get 1 warning, afterwards its Fed time.</li>
39 | <li>Do not spam the staff's mailbox, if you have a problem, message one of us once. They will deal with your problem in a timely
40 | manner, but do not mail them repeatedly, or mail multiple staff members.</li>
41 | <li>Do not harrass other players, use common sense on this one, if you don't know when your crossing the line from fantasy into
42 | harrassment, assume that you are harrassing the other player. This will not be tolerated and will result in a stiff punishment.</li>
43 | <li>Scamming will not be tolerated in any manner. Any attempt to scam anyone will result in being jailed for a long long time.</li>
44 | <li>If a member of staff is bothering you for any unfair or just plain, weird reason, mail admin [1]</li>
45 | <li>Common sense rules are not posted here, if you can't determine the difference between what is ok, and what is not, you should
46 | consider not interacting with other people until you do understand.</li>
47 | <li>These rules are subject to change without notice, check them from time to time, as ignorance will not be accepted as an excuse.</li>
48 | </ol>
49 | EOF;
50 | $h->endpage();
51 | 


--------------------------------------------------------------------------------
/explore.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $tresder = (int) rand(100, 999);
28 | print
29 |         "<b>You begin exploring the area you're in, you see a bit that interests you.</b><br />
30 | <table width=75%><tr height=100><td valign=top>
31 | <u>Market Place</u><br />
32 | <a href='shops.php'>Shops</a><br />
33 | <a href='itemmarket.php'>Item Market</a><br />
34 | <a href='cmarket.php'>Crystal Market</a></td>
35 | <td valign=top
36 | <u>Serious Money Makers</u><br />
37 | <a href='monorail.php'>Travel Agency</a><br />
38 | <a href='estate.php'>Estate Agent</a><br />
39 | <a href='bank.php'>City Bank</a></td>
40 | <td valign=top>";
41 | if ($ir['location'] == 5)
42 | {
43 |     print
44 |             "<u>Cyber State</u><br />
45 | <a href='cyberbank.php'>Cyber Bank</a><br />";
46 | }
47 | print
48 |         "</td><td valign=top>
49 | <u>Dark Side</u><br />
50 | <a href='fedjail.php'>Federal Jail</a><br />
51 | <a href='slotsmachine.php?tresde=$tresder'>Slots Machine</a><br />
52 | <a href='roulette.php?tresde=$tresder'>Roulette</a></td></tr><tr height=100>
53 | <td valign=top>";
54 | if ($ir['location'] == 5)
55 | {
56 |     print
57 |             "<u>Cyber Casino</u><br />
58 | <a href='slotsmachine3.php'>Super Slots</a><br />";
59 | }
60 | print
61 |         "</td><td valign=top>
62 | <u>Statistics Dept</u><br />
63 | <a href='userlist.php'>User List</a><br />
64 | <a href='stafflist.php'>breakthenet Staff</a><br />
65 | <a href='halloffame.php'>Hall of Fame</a><br />
66 | <a href='stats.php'>Game Stats</a><br />
67 | <a href='usersonline.php'>Users Online</a></td><td valign=top>&nbsp;</td><td valign=top>
68 | <u>Mysterious</u><br />
69 | <a href='crystaltemple.php'>Crystal Temple</a><br />";
70 | if ($ir['location'] == 4)
71 | {
72 |     print "<a href='battletent.php'>Battle Tent</a><br />";
73 | }
74 | $game_url = determine_game_urlbase();
75 | print
76 |         "</td></tr></table><br /><br />This is your referal link: http://{$game_url}/register.php?REF=$userid <br />
77 | Every signup from this link earns you two valuable crystals!";
78 | $h->endpage();
79 | 


--------------------------------------------------------------------------------
/willpotion.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $game_url = determine_game_urlbase();
28 | print
29 |         <<<EOF
30 | <h3>Will Potions</h3>
31 | 
32 | Buy will potions today! They restore 100% will.<br />
33 | <b>Buy One:</b> (\$1)<br />
34 | <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
35 | <input type="hidden" name="cmd" value="_xclick">
36 | <input type="hidden" name="business" value="teachthenet@gmail.com">
37 | <input type="hidden" name="item_name" value="Will Potion for ($userid) (1)">
38 | <input type="hidden" name="amount" value="1.00">
39 | <input type="hidden" name="no_shipping" value="1">
40 | <input type="hidden" name="return" value="http://{$game_url}/willpdone.php?action=done&quantity=one">
41 | <input type="hidden" name="cancel_return" value="http://{$game_url}/willpdone.php?action=cancel">
42 | <input type="hidden" name="cn" value="Your Player ID">
43 | <input type="hidden" name="currency_code" value="USD">
44 | <input type="hidden" name="tax" value="0">
45 | <input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but21.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
46 | </form>
47 | <b>Buy Five:</b> (\$4.50)<br />
48 | <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
49 | <input type="hidden" name="cmd" value="_xclick">
50 | <input type="hidden" name="business" value="teachthenet@gmail.com">
51 | <input type="hidden" name="item_name" value="Will Potion for ($userid) (5)">
52 | <input type="hidden" name="amount" value="4.50">
53 | <input type="hidden" name="no_shipping" value="1">
54 | <input type="hidden" name="return" value="http://{$game_url}/willpdone.php?action=done&quantity=five">
55 | <input type="hidden" name="cancel_return" value="http://{$game_url}/willpdone.php?action=cancel">
56 | <input type="hidden" name="cn" value="Your Player ID">
57 | <input type="hidden" name="currency_code" value="USD">
58 | <input type="hidden" name="tax" value="0">
59 | <input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but21.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
60 | </form>
61 | EOF;
62 | $h->endpage();
63 | 


--------------------------------------------------------------------------------
/estate.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $mpq = mysql_query("SELECT * FROM houses WHERE hWILL={$ir['maxwill']}", $c);
28 | $mp = mysql_fetch_array($mpq);
29 | $_GET['property'] = abs((int) $_GET['property']);
30 | if ($_GET['property'])
31 | {
32 |     $npq =
33 |             mysql_query("SELECT * FROM houses WHERE hID={$_GET['property']}",
34 |                     $c);
35 |     $np = mysql_fetch_array($npq);
36 |     if ($np['hWILL'] < $mp['hWILL'])
37 |     {
38 |         print "You cannot go backwards in houses!";
39 |     }
40 |     else if ($np['hPRICE'] > $ir['money'])
41 |     {
42 |         print "You do not have enough money to buy the {$np['hrNAME']}.";
43 |     }
44 |     else
45 |     {
46 |         mysql_query(
47 |                 "UPDATE users SET money=money-{$np['hPRICE']},will=0,maxwill={$np['hWILL']} WHERE userid=$userid",
48 |                 $c);
49 |         print "Congrats, you bought the {$np['hNAME']} for \${$np['hPRICE']}!";
50 |     }
51 | }
52 | else if (isset($_GET['sellhouse']))
53 | {
54 |     $npq =
55 |             mysql_query("SELECT * FROM houses WHERE hWILL={$ir['maxwill']}",
56 |                     $c);
57 |     $np = mysql_fetch_array($npq);
58 |     if ($ir['maxwill'] == 100)
59 |     {
60 |         print "You already live in the lowest property!";
61 |     }
62 |     else
63 |     {
64 |         mysql_query(
65 |                 "UPDATE users SET money=money+{$np['hPRICE']},will=0,maxwill=100 WHERE userid=$userid",
66 |                 $c);
67 |         print "You sold your {$np['hNAME']} and went back to your shed.";
68 |     }
69 | }
70 | else
71 | {
72 |     print
73 |             "Your current property: <b>{$mp['hNAME']}</b><br />
74 | The houses you can buy are listed below. Click a house to buy it.<br />";
75 |     if ($ir['maxwill'] > 100)
76 |     {
77 |         print "<a href='estate.php?sellhouse'>Sell Your House</a><br />";
78 |     }
79 |     $hq =
80 |             mysql_query(
81 |                     "SELECT * FROM houses WHERE hWILL>{$ir['maxwill']} ORDER BY hWILL ASC",
82 |                     $c);
83 |     while ($r = mysql_fetch_array($hq))
84 |     {
85 |         print
86 |                 "<a href='estate.php?property={$r['hID']}'>{$r['hNAME']}</a>&nbsp;&nbsp - Cost: \${$r['hPRICE']}&nbsp;&nbsp - Will Bar: {$r['hWILL']}<br />";
87 |     }
88 | }
89 | $h->endpage();
90 | 


--------------------------------------------------------------------------------
/userlist.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['st'] = abs((int) $_GET['st']);
28 | $st = ($_GET['st']) ? $_GET['st'] : 0;
29 | $allowed_by = array('userid', 'username', 'level', 'money');
30 | $by = (in_array($_GET['by'], $allowed_by)) ? $_GET['by'] : 'userid';
31 | $allowed_ord = array('asc', 'desc', 'ASC', 'DESC');
32 | $ord = (in_array($_GET['ord'], $allowed_ord)) ? $_GET['ord'] : 'ASC';
33 | print "<h3>Userlist</h3>";
34 | $cnt = mysql_query("SELECT userid FROM users", $c);
35 | $membs = mysql_num_rows($cnt);
36 | $pages = (int) ($membs / 100) + 1;
37 | if ($membs % 100 == 0)
38 | {
39 |     $pages--;
40 | }
41 | print "Pages: ";
42 | for ($i = 1; $i <= $pages; $i++)
43 | {
44 |     $stl = ($i - 1) * 100;
45 |     print "<a href='userlist.php?st=$stl&by=$by&ord=$ord'>$i</a>&nbsp;";
46 | }
47 | print
48 |         "<br />
49 | Order By: <a href='userlist.php?st=$st&by=userid&ord=$ord'>User ID</a>&nbsp;| <a href='userlist.php?st=$st&by=username&ord=$ord'>Username</a>&nbsp;| <a href='userlist.php?st=$st&by=level&ord=$ord'>Level</a>&nbsp;| <a href='userlist.php?st=$st&by=money&ord=$ord'>Money</a><br />
50 | <a href='userlist.php?st=$st&by=$by&ord=asc'>Ascending</a>&nbsp;| <a href='userlist.php?st=$st&by=$by&ord=desc'>Descending</a><br /><br />";
51 | $q =
52 |         mysql_query(
53 |                 "SELECT u.* FROM users u ORDER BY $by $ord LIMIT $st,100",
54 |                 $c);
55 | $no1 = $st + 1;
56 | $no2 = $st + 100;
57 | print
58 |         "Showing users $no1 to $no2 by order of $by $ord.
59 | <table width=75% border=2><tr style='background:gray'><th>ID</th><th>Name</th><th>Money</th><th>Level</th><th>Gender</th><th>Online</th></tr>";
60 | while ($r = mysql_fetch_array($q))
61 | {
62 |     $d = "";
63 |     if ($r['donatordays'])
64 |     {
65 |         $r['username'] = "<font color=red>{$r['username']}</font>";
66 |         $d =
67 |                 "<img src='donator.gif' alt='Donator: {$r['donatordays']} Days Left' title='Donator: {$r['donatordays']} Days Left' />";
68 |     }
69 |     print
70 |             "<tr><td>{$r['userid']}</td><td><a href='viewuser.php?u={$r['userid']}'>{$r['username']} $d</a></td><td>\${$r['money']}</td><td>{$r['level']}</td><td>{$r['gender']}</td><td>";
71 |     if ($r['laston'] >= time() - 15 * 60)
72 |     {
73 |         print "<font color=green><b>Online</b></font>";
74 |     }
75 |     else
76 |     {
77 |         print "<font color=red><b>Offline</b></font>";
78 |     }
79 |     print "</td></tr>";
80 | }
81 | print "</table>";
82 | 
83 | $h->endpage();
84 | 


--------------------------------------------------------------------------------
/shops.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | $_GET['shop'] = abs((int) $_GET['shop']);
28 | if (!$_GET['shop'])
29 | {
30 |     print "You begin looking through town and you see a few shops.<br />";
31 |     $q =
32 |             mysql_query(
33 |                     "SELECT * FROM shops WHERE shopLOCATION={$ir['location']}",
34 |                     $c);
35 |     print
36 |             "<table width=85%><tr style='background: gray;'><th>Shop</th><th>Description</th></tr>";
37 |     while ($r = mysql_fetch_array($q))
38 |     {
39 |         print
40 |                 "<tr><td><a href='shops.php?shop={$r['shopID']}'>{$r['shopNAME']}</a></td><td>{$r['shopDESCRIPTION']}</td></tr>";
41 |     }
42 |     print "</table>";
43 | }
44 | else
45 | {
46 |     $sd = mysql_query("SELECT * FROM shops WHERE shopID={$_GET['shop']}", $c);
47 |     if (mysql_num_rows($sd))
48 |     {
49 |         $shopdata = mysql_fetch_array($sd);
50 |         if ($shopdata['shopLOCATION'] == $ir['location'])
51 |         {
52 |             print
53 |                     "Browsing items at <b>{$shopdata['shopNAME']}...</b><br />
54 | <table><tr style='background: gray;'><th>Item</th><th>Description</th><th>Price</th><th>Sell Price</th><th>Buy</th></tr>";
55 |             $qtwo =
56 |                     mysql_query(
57 |                             "SELECT si.*,i.*,it.* FROM shopitems si LEFT JOIN items i ON si.sitemITEMID=i.itmid LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid WHERE si.sitemSHOP={$_GET['shop']} ORDER BY i.itmtype ASC, i.itmbuyprice ASC, i.itmname ASC",
58 |                             $c) or die(mysql_error());
59 |             $lt = "";
60 |             while ($r = mysql_fetch_array($qtwo))
61 |             {
62 |                 if ($lt != $r['itmtypename'])
63 |                 {
64 |                     $lt = $r['itmtypename'];
65 |                     print
66 |                             "\n<tr style='background: gray;'><th colspan=5>{$lt}</th></tr>";
67 |                 }
68 |                 print
69 |                         "\n<tr><td>{$r['itmname']}</td><td>{$r['itmdesc']}</td><td>\${$r['itmbuyprice']}</td><td>\${$r['itmsellprice']}</td><td><form action='itembuy.php?ID={$r['itmid']}' method='post'>Qty: <input type='text' name='qty' value='1' /><input type='submit' value='Buy' /></form></td></tr>";
70 |             }
71 |             print "</table>";
72 |         }
73 |         else
74 |         {
75 |             print "You are trying to access a shop in another city!";
76 |         }
77 |     }
78 |     else
79 |     {
80 |         print "You are trying to access an invalid shop!";
81 |     }
82 | }
83 | $h->endpage();
84 | 


--------------------------------------------------------------------------------
/attackhosp.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm, 0);
26 | $h->menuarea();
27 | 
28 | $_GET['ID'] = abs((int) $_GET['ID']);
29 | $_SESSION['attacking'] = 0;
30 | $od = mysql_query("SELECT * FROM users WHERE userid={$_GET['ID']}", $c);
31 | if ($_SESSION['attackwon'] != $_GET['ID'])
32 | {
33 |     die("Cheaters don't get anywhere.");
34 | }
35 | if (mysql_num_rows($od))
36 | {
37 |     $r = mysql_fetch_array($od);
38 |     if ($r['hp'] == 1)
39 |     {
40 |         print "What a cheater you are.";
41 |     }
42 |     else
43 |     {
44 |         print "You beat {$r['username']} and hospitalized them.";
45 | 
46 |         event_add($r['userid'],
47 |                 "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> hospitalized you.",
48 |                 $c);
49 | 
50 |         mysql_query(
51 |                 "UPDATE users SET hp=1,hospital=hospital+80+(rand()*230),hospreason='Hospitalized by <a href=\'viewuser.php?u={$userid}\'>{$ir['username']}</a>' WHERE userid={$r['userid']}",
52 |                 $c);
53 |         $atklog = mysql_escape_string($_SESSION['attacklog']);
54 |         mysql_query(
55 |                 "INSERT INTO attacklogs VALUES(NULL,$userid,{$_GET['ID']},'won',"
56 |                         . time() . ",-1,'$atklog');", $c);
57 |         $_SESSION['attackwon'] = 0;
58 |         $bots = array(263, 264, 265, 2477, 2479, 2480, 2481, 0, 0, 0, 0, 0, 0);
59 |         $moneys =
60 |                 array(263 => 10000, 264 => 10000, 265 => 15500, 2477 => 80000,
61 |                         2479 => 30000, 2480 => 30000, 2481 => 30000,
62 |                         0 => 100000, 0 => 1400000, 0 => 1400000, 0 => 1400000,
63 |                         0 => 5000000, 0 => 10000000);
64 |         if (in_array($r['userid'], $bots))
65 |         {
66 |             $qk =
67 |                     mysql_query(
68 |                             "SELECT * FROM challengesbeaten WHERE userid=$userid AND npcid={$r['userid']}",
69 |                             $c);
70 |             if (!mysql_num_rows($qk))
71 |             {
72 |                 $gain = $moneys[$r['userid']];
73 |                 mysql_query(
74 |                         "UPDATE users SET money=money+$gain WHERE userid=$userid",
75 |                         $c);
76 |                 mysql_query(
77 |                         "INSERT INTO challengesbeaten VALUES ($userid,{$r['userid']})",
78 |                         $c);
79 |                 print
80 |                         "<br /><br />Congrats, you have beaten the Challenge BOT {$r['username']}, you have earnt \$$gain!";
81 |             }
82 |         }
83 |     }
84 | }
85 | else
86 | {
87 |     print "You beat Mr. non-existant!";
88 | }
89 | $h->endpage();
90 | 


--------------------------------------------------------------------------------
/js/login.js:
--------------------------------------------------------------------------------
  1 | /*
  2 | MCCodes FREE
  3 | js/login.js Rev 1.1.0c
  4 | Copyright (C) 2005-2012 Dabomstew
  5 | 
  6 | This program is free software; you can redistribute it and/or
  7 | modify it under the terms of the GNU General Public License
  8 | as published by the Free Software Foundation; either version 2
  9 | of the License, or (at your option) any later version.
 10 | 
 11 | This program is distributed in the hope that it will be useful,
 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of
 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14 | GNU General Public License for more details.
 15 | 
 16 | You should have received a copy of the GNU General Public License
 17 | along with this program; if not, write to the Software
 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 19 | */
 20 | function getCookieVal(offset)
 21 | {
 22 |     var endstr = document.cookie.indexOf(";", offset);
 23 |     if (endstr == -1)
 24 |         endstr = document.cookie.length;
 25 |     return unescape(document.cookie.substring(offset, endstr));
 26 | }
 27 | function GetCookie(name)
 28 | {
 29 |     var arg = name + "=";
 30 |     var alen = arg.length;
 31 |     var clen = document.cookie.length;
 32 |     var i = 0;
 33 |     while (i < clen)
 34 |     {
 35 |         var j = i + alen;
 36 |         if (document.cookie.substring(i, j) == arg)
 37 |             return getCookieVal(j);
 38 |         i = document.cookie.indexOf(" ", i) + 1;
 39 |         if (i == 0)
 40 |             break;
 41 |     }
 42 |     return null;
 43 | }
 44 | function SetCookie(name, value, expires, path, domain, secure)
 45 | {
 46 |     document.cookie = name + "=" + escape(value)
 47 |             + ((expires) ? "; expires=" + expires.toGMTString() : "")
 48 |             + ((path) ? "; path=" + path : "")
 49 |             + ((domain) ? "; domain=" + domain : "")
 50 |             + ((secure) ? "; secure" : "");
 51 | }
 52 | 
 53 | function DeleteCookie(name, path, domain)
 54 | {
 55 |     if (GetCookie(name))
 56 |     {
 57 |         document.cookie = name + "=" + ((path) ? "; path=" + path : "")
 58 |                 + ((domain) ? "; domain=" + domain : "")
 59 |                 + "; expires=Thu, 01-Jan-70 00:00:01 GMT";
 60 |     }
 61 | }
 62 | var usr;
 63 | var pw;
 64 | var sv;
 65 | function getme()
 66 | {
 67 |     usr = document.login.username;
 68 |     pw = document.login.password;
 69 |     sv = document.login.save;
 70 | 
 71 |     if (GetCookie('username') != null)
 72 |     {
 73 |         usr.value = GetCookie('username');
 74 |         pw.value = GetCookie('password');
 75 |     }
 76 |     if (GetCookie('save') == 'true')
 77 |     {
 78 |         sv[0].checked = true;
 79 |     }
 80 |     else
 81 |     {
 82 |         sv[1].checked = true;
 83 |     }
 84 | 
 85 | }
 86 | function saveme()
 87 | {
 88 |     if (usr.value.length != 0 && pw.value.length != 0)
 89 |     {
 90 |         if (sv[0].checked)
 91 |         {
 92 |             expdate = new Date();
 93 |             expdate.setTime(expdate.getTime() + 31536000000);
 94 |             SetCookie('username', usr.value, expdate);
 95 |             SetCookie('password', pw.value, expdate);
 96 |             SetCookie('save', 'true', expdate);
 97 |         }
 98 |         if (sv[1].checked)
 99 |         {
100 |             DeleteCookie('username');
101 |             DeleteCookie('password');
102 |             DeleteCookie('save');
103 |         }
104 |     }
105 |     else
106 |     {
107 |         alert('You must enter a username/password.');
108 |         return false;
109 |     }
110 | }


--------------------------------------------------------------------------------
/roulette.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $tresder = (int) (rand(100, 999));
 28 | $maxbet = $ir['level'] * 150;
 29 | $_GET['tresde'] = abs((int) $_GET['tresde']);
 30 | if (($_SESSION['tresde'] == $_GET['tresde']) || $_GET['tresde'] < 100)
 31 | {
 32 |     die(
 33 |             "Error, you cannot refresh or go back on the slots, please use a side link to go somewhere else.<br />
 34 | <a href='roulette.php?tresde=$tresder'>&gt; Back</a>");
 35 | }
 36 | $_SESSION['tresde'] = $_GET['tresde'];
 37 | $_GET['bet'] = abs((int) $_GET['bet']);
 38 | $_GET['number'] = abs((int) $_GET['number']);
 39 | print "<h3>Roulette: Pick a number between 0 - 36</h3>";
 40 | if ($_GET['bet'])
 41 | {
 42 |     if ($_GET['bet'] > $ir['money'])
 43 |     {
 44 |         die(
 45 |                 "You are trying to bet more than you have.<br />
 46 | <a href='roulette.php?tresde=$tresder'>&gt; Back</a>");
 47 |     }
 48 |     else if ($_GET['bet'] > $maxbet)
 49 |     {
 50 |         die(
 51 |                 "You have gone over the max bet.<br />
 52 | <a href='roulette.php?tresde=$tresder'>&gt; Back</a>");
 53 |     }
 54 |     else if ($_GET['number'] > 36 or $_GET['number'] < 0 or $_GET['bet'] < 0)
 55 |     {
 56 |         die(
 57 |                 "The Numbers are only 0 - 36.<br />
 58 | <a href='roulette.php?tresde=$tresder'>&gt; Back</a>");
 59 |     }
 60 | 
 61 |     $slot[1] = (int) rand(0, 36);
 62 |     print
 63 |             "You place \${$_GET['bet']} into the slot and pull the pole.<br />
 64 | You see the number: <b>$slot[1]</b><br />
 65 | You bet \${$_GET['bet']} ";
 66 |     if ($slot[1] == $_GET['number'])
 67 |     {
 68 |         $won = $_GET['bet'] * 37;
 69 |         $gain = $_GET['bet'] * 36;
 70 |         print
 71 |                 "and won \$$won by matching the number u bet pocketing you \$$gain extra.";
 72 |     }
 73 |     else
 74 |     {
 75 |         $won = 0;
 76 |         $gain = -$_GET['bet'];
 77 |         print "and lost it.";
 78 |     }
 79 |     mysql_query(
 80 |             "UPDATE users SET money=money+({$gain}) where userid=$userid", $c);
 81 |     $tresder = (int) (rand(100, 999));
 82 |     print
 83 |             "<br />
 84 | <a href='roulette.php?bet={$_GET['bet']}&tresde=$tresder&number={$_GET['number']}'>&gt; Another time, same bet.</a><br />
 85 | <a href='roulette.php?tresde=$tresder'>&gt; I'll continue, but I'm changing my bet.</a><br />
 86 | <a href='explore.php'>&gt; Enough's enough, I'm off.</a>";
 87 | }
 88 | else
 89 | {
 90 |     print
 91 |             "Ready to try your luck? Play today!<br />
 92 | The maximum bet for your level is \$$maxbet.<br />
 93 | <form action='roulette.php' method='get'>
 94 | Bet: \$<input type='text' name='bet' value='5' /><br />
 95 | Pick (0-36): <input type='text' name='number' value='18' /><br />
 96 | <input type='hidden' name='tresde' value='$tresder' />
 97 | <input type='submit' value='Play!!' />
 98 | </form>";
 99 | }
100 | 
101 | $h->endpage();
102 | 


--------------------------------------------------------------------------------
/slotsmachine.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $tresder = (int) (rand(100, 999));
 28 | $maxbet = $ir['level'] * 250;
 29 | $_GET['tresde'] = abs((int) $_GET['tresde']);
 30 | if (($_SESSION['tresde'] == $_GET['tresde']) || $_GET['tresde'] < 100)
 31 | {
 32 |     die(
 33 |             "Error, you cannot refresh or go back on the slots, please use a side link to go somewhere else.<br />
 34 | <a href='slotsmachine.php?tresde=$tresder'>&gt; Back</a>");
 35 | }
 36 | $_SESSION['tresde'] = $_GET['tresde'];
 37 | $_GET['bet'] = abs((int) $_GET['bet']);
 38 | print "<h3>Slots</h3>";
 39 | if ($_GET['bet'])
 40 | {
 41 |     if ($_GET['bet'] > $ir['money'])
 42 |     {
 43 |         die(
 44 |                 "You are trying to bet more than you have.<br />
 45 | <a href='slotsmachine.php?tresde=$tresder'>&gt; Back</a>");
 46 |     }
 47 |     else if ($_GET['bet'] > $maxbet)
 48 |     {
 49 |         die(
 50 |                 "You have gone over the max bet.<br />
 51 | <a href='slotsmachine.php?tresde=$tresder'>&gt; Back</a>");
 52 |     }
 53 | 
 54 |     $slot[1] = (int) rand(0, 9);
 55 |     $slot[2] = (int) rand(0, 9);
 56 |     $slot[3] = (int) rand(0, 9);
 57 |     print
 58 |             "You place \${$_GET['bet']} into the slot and pull the pole.<br />
 59 | You see the numbers: <b>$slot[1] $slot[2] $slot[3]</b><br />
 60 | You bet \${$_GET['bet']} ";
 61 |     if ($slot[1] == $slot[2] && $slot[2] == $slot[3])
 62 |     {
 63 |         $won = $_GET['bet'] * 26;
 64 |         $gain = $_GET['bet'] * 25;
 65 |         print
 66 |                 "and won \$$won by lining up 3 numbers pocketing you \$$gain extra.";
 67 |     }
 68 |     else if ($slot[1] == $slot[2] || $slot[2] == $slot[3]
 69 |             || $slot[1] == $slot[3])
 70 |     {
 71 |         $won = $_GET['bet'] * 3;
 72 |         $gain = $_GET['bet'] * 2;
 73 |         print
 74 |                 "and won \$$won by lining up 2 numbers pocketing you \$$gain extra.";
 75 |     }
 76 |     else
 77 |     {
 78 |         $won = 0;
 79 |         $gain = -$_GET['bet'];
 80 |         print "and lost it.";
 81 |     }
 82 |     mysql_query(
 83 |             "UPDATE users SET money=money+({$gain}) where userid=$userid", $c);
 84 |     $tresder = (int) (rand(100, 999));
 85 |     print
 86 |             "<br />
 87 | <a href='slotsmachine.php?bet={$_GET['bet']}&tresde=$tresder'>&gt; Another time, same bet.</a><br />
 88 | <a href='slotsmachine.php?tresde=$tresder'>&gt; I'll continue, but I'm changing my bet.</a><br />
 89 | <a href='explore.php'>&gt; Enough's enough, I'm off.</a>";
 90 | }
 91 | else
 92 | {
 93 |     print
 94 |             "Ready to try your luck? Play today!<br />
 95 | The maximum bet for your level is \$$maxbet.<br />
 96 | <form action='slotsmachine.php' method='get'>
 97 | Bet: \$<input type='text' name='bet' value='5' /><br />
 98 | <input type='hidden' name='tresde' value='$tresder' />
 99 | <input type='submit' value='Play!!' />
100 | </form>";
101 | }
102 | 
103 | $h->endpage();
104 | 


--------------------------------------------------------------------------------
/attackwon.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm, 0);
26 | $h->menuarea();
27 | 
28 | $_GET['ID'] = abs((int) $_GET['ID']);
29 | $_SESSION['attacking'] = 0;
30 | $od = mysql_query("SELECT * FROM users WHERE userid={$_GET['ID']}", $c);
31 | if ($_SESSION['attackwon'] != $_GET['ID'])
32 | {
33 |     die("Cheaters don't get anywhere.");
34 | }
35 | if (mysql_num_rows($od))
36 | {
37 |     $r = mysql_fetch_array($od);
38 |     if ($r['hp'] == 1)
39 |     {
40 |         print "What a cheater u are.";
41 |     }
42 |     else
43 |     {
44 |         $stole = (int) (rand($r['money'] / 500, $r['money'] / 20));
45 |         print "You beat {$r['username']} and stole \$$stole";
46 |         $qe = $r['level'] * $r['level'] * $r['level'];
47 |         $expgain = rand($qe / 4, $qe / 2);
48 |         $expperc = (int) ($expgain / $ir['exp_needed'] * 100);
49 |         print " and gained $expperc% EXP!";
50 |         mysql_query(
51 |                 "UPDATE users SET exp=exp+$expgain,money=money+$stole WHERE userid=$userid",
52 |                 $c);
53 |         mysql_query(
54 |                 "UPDATE users SET hp=1,money=money-$stole WHERE userid={$r['userid']}",
55 |                 $c);
56 |         event_add($r['userid'],
57 |                 "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> attacked you and stole $stole.",
58 |                 $c);
59 |         $atklog = mysql_escape_string($_SESSION['attacklog']);
60 |         mysql_query(
61 |                 "INSERT INTO attacklogs VALUES(NULL,$userid,{$_GET['ID']},'won',"
62 |                         . time() . ",$stole,'$atklog');", $c);
63 |         $_SESSION['attackwon'] = 0;
64 |         $bots = array(2477, 2479, 2480, 2481, 263, 264, 265);
65 |         $moneys =
66 |                 array(2477 => 80000, 2479 => 30000, 2480 => 30000,
67 |                         2481 => 30000, 263 => 10000, 264 => 10000,
68 |                         265 => 15000, 536 => 100000, 720 => 1400000,
69 |                         721 => 1400000, 722 => 1400000, 585 => 5000000,
70 |                         820 => 10000000);
71 |         if (in_array($r['userid'], $bots))
72 |         {
73 |             $qk =
74 |                     mysql_query(
75 |                             "SELECT * FROM challengesbeaten WHERE userid=$userid AND npcid={$r['userid']}",
76 |                             $c);
77 |             if (!mysql_num_rows($qk))
78 |             {
79 |                 $gain = $moneys[$r['userid']];
80 |                 mysql_query(
81 |                         "UPDATE users SET money=money+$gain WHERE userid=$userid",
82 |                         $c);
83 |                 mysql_query(
84 |                         "INSERT INTO challengesbeaten VALUES ($userid,{$r['userid']})",
85 |                         $c);
86 |                 print
87 |                         "<br /><br />Congrats, for beating the Challenge Bot {$r['username']}, you have earnt \$$gain!";
88 |             }
89 |         }
90 |     }
91 | }
92 | else
93 | {
94 |     print "You beat Mr. non-existant!";
95 | }
96 | $h->endpage();
97 | 


--------------------------------------------------------------------------------
/number.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $tresder = (int) (rand(100, 999));
 28 | $maxbet = $ir['level'] * 1;
 29 | $_GET['tresde'] = abs((int) $_GET['tresde']);
 30 | if (($_SESSION['tresde'] == $_GET['tresde']) || $_GET['tresde'] < 100)
 31 | {
 32 |     die(
 33 |             "Error, you cannot refresh or go back on the slots, please use a side link to go somewhere else.<br />
 34 | <a href='number.php?tresde=$tresder'>&gt; Back</a>");
 35 | }
 36 | $_SESSION['tresde'] = $_GET['tresde'];
 37 | $_GET['crystals'] = abs((int) $_GET['crystals']);
 38 | $_GET['number'] = abs((int) $_GET['number']);
 39 | print "<h3>Pick a number between 1 - 3 and double your bet of crystals</h3>";
 40 | if ($_GET['crystals'])
 41 | {
 42 |     if ($_GET['crystals'] > $ir['crystals'])
 43 |     {
 44 |         die(
 45 |                 "You are trying to bet more than you have.<br />
 46 | <a href='number.php?tresde=$tresder'>&gt; Back</a>");
 47 |     }
 48 |     else if ($_GET['crystals'] > $maxbet)
 49 |     {
 50 |         die(
 51 |                 "You have gone over the max bet.<br />
 52 | <a href='roulette.php?tresde=$tresder'>&gt; Back</a>");
 53 |     }
 54 |     else if ($_GET['number'] > 3 or $_GET['number'] < 1 or $_GET['bet'] < 0)
 55 |     {
 56 |         die(
 57 |                 "The Numbers are only 1 - 3.<br />
 58 | <a href='number.php?tresde=$tresder'>&gt; Back</a>");
 59 |     }
 60 | 
 61 |     $slot[1] = (int) rand(1, 3);
 62 |     print
 63 |             "You place \${$_GET['crystals']} into the slot and pull the pole.<br />
 64 | You see the number: <b>$slot[1]</b><br />
 65 | You bet \${$_GET['crystals']} ";
 66 |     if ($slot[1] == $_GET['number'])
 67 |     {
 68 |         $won = $_GET['crystals'] * 2;
 69 |         $gain = $_GET['crystals'] * 1;
 70 |         print
 71 |                 "and won \$$won by matching the number u bet pocketing you \$$gain extra.";
 72 |     }
 73 |     else
 74 |     {
 75 |         $won = 0;
 76 |         $gain = -$_GET['crystals'];
 77 |         print "and lost it.";
 78 |     }
 79 |     mysql_query(
 80 |             "UPDATE users SET crystals=crystals+({$gain}) where userid=$userid",
 81 |             $c);
 82 |     $tresder = (int) (rand(100, 999));
 83 |     print
 84 |             "<br />
 85 | <a href='number.php?bet={$_GET['bet']}&tresde=$tresder&number={$_GET['number']}'>&gt; Another time, same bet.</a><br />
 86 | <a href='number.php?tresde=$tresder'>&gt; I'll continue, but I'm changing my bet.</a><br />
 87 | <a href='explore.php'>&gt; Enough's enough, I'm off.</a>";
 88 | }
 89 | else
 90 | {
 91 |     print
 92 |             "Ready to try your luck? Play today!<br />
 93 | The maximum bet for your level is \$maxbet.<br />
 94 | <form action='number.php' method='get'>
 95 | Bet: \$<input type='text' name='bet' value='5' /><br />
 96 | Pick (1-3): <input type='text' name='number' value='2' /><br />
 97 | <input type='hidden' name='tresde' value='$tresder' />
 98 | <input type='submit' value='Play!!' />
 99 | </form>";
100 | }
101 | 
102 | $h->endpage();
103 | 


--------------------------------------------------------------------------------
/itemsell.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $_GET['ID'] = abs((int) $_GET['ID']);
 28 | $_GET['qty'] = abs((int) $_GET['qty']);
 29 | //itemsend
 30 | if ($_GET['qty'])
 31 | {
 32 |     $id =
 33 |             mysql_query(
 34 |                     "SELECT iv.*,it.* FROM inventory iv LEFT JOIN items it ON iv.inv_itemid=it.itmid WHERE iv.inv_id={$_GET['ID']} AND iv.inv_userid=$userid LIMIT 1",
 35 |                     $c);
 36 |     if (mysql_num_rows($id) == 0)
 37 |     {
 38 |         print "Invalid item ID";
 39 |     }
 40 |     else
 41 |     {
 42 |         $r = mysql_fetch_array($id);
 43 |         if ($_GET['qty'] > $r['inv_qty'])
 44 |         {
 45 |             print "You are trying to send more than you have!";
 46 |         }
 47 |         else
 48 |         {
 49 |             $price = $r['itmsellprice'] * $_GET['qty'];
 50 |             //are we sending it all
 51 |             if ($_GET['qty'] == $r['inv_qty'])
 52 |             {
 53 |                 //just give them possession of the item
 54 |                 mysql_query(
 55 |                         "DELETE FROM inventory WHERE inv_id={$_GET['ID']}",
 56 |                         $c);
 57 |             }
 58 |             else
 59 |             {
 60 |                 //create seperate
 61 |                 mysql_query(
 62 |                         "UPDATE inventory SET inv_qty=inv_qty-{$_GET['qty']} WHERE inv_id={$_GET['ID']} LIMIT 1;",
 63 |                         $c);
 64 |             }
 65 |             mysql_query(
 66 |                     "UPDATE users SET money=money+{$price} WHERE userid=$userid",
 67 |                     $c);
 68 |             $priceh = "$" . ($price);
 69 |             print "You sold {$_GET['qty']} {$r['itmname']}(s) for {$priceh}";
 70 |             mysql_query(
 71 |                     "INSERT INTO itemselllogs VALUES(NULL, $userid, {$r['itmid']}, $price, {$_GET['qty']}, "
 72 |                             . time()
 73 |                             . ", '{$ir['username']} sold {$_GET['qty']} {$r['itmname']}(s) for {$priceh}')",
 74 |                     $c);
 75 |         }
 76 |     }
 77 | }
 78 | else if ($_GET['ID'])
 79 | {
 80 |     $id =
 81 |             mysql_query(
 82 |                     "SELECT iv.*,it.* FROM inventory iv LEFT JOIN items it ON iv.inv_itemid=it.itmid WHERE iv.inv_id={$_GET['ID']} and iv.inv_userid=$userid LIMIT 1",
 83 |                     $c);
 84 |     if (mysql_num_rows($id) == 0)
 85 |     {
 86 |         print "Invalid item ID";
 87 |     }
 88 |     else
 89 |     {
 90 |         $r = mysql_fetch_array($id);
 91 |         print
 92 |                 "<b>Enter how many {$r['itmname']} you want to sell. You have {$r['inv_qty']} to sell.</b><br />
 93 | <form action='itemsell.php' method='get'>
 94 | <input type='hidden' name='ID' value='{$_GET['ID']}' />
 95 | Quantity: <input type='text' name='qty' value='' /><br />
 96 | <input type='submit' value='Sell Items (no prompt so be sure!' /></form>";
 97 |     }
 98 | }
 99 | else
100 | {
101 |     print "Invalid use of file.";
102 | }
103 | $h->endpage();
104 | 


--------------------------------------------------------------------------------
/education.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | print "<h3>Schooling</h3>";
 28 | if ($ir['course'] > 0)
 29 | {
 30 |     $cd = mysql_query("SELECT * FROM courses WHERE crID={$ir['course']}", $c);
 31 |     $coud = mysql_fetch_array($cd);
 32 |     print
 33 |             "You are currently doing the {$coud['crNAME']}, you have {$ir['cdays']} days remaining.";
 34 | }
 35 | else
 36 | {
 37 |     if ($_GET['cstart'])
 38 |     {
 39 |         $_GET['cstart'] = abs((int) $_GET['cstart']);
 40 |         //Verify.
 41 |         $cd =
 42 |                 mysql_query(
 43 |                         "SELECT * FROM courses WHERE crID={$_GET['cstart']}",
 44 |                         $c);
 45 |         if (mysql_num_rows($cd) == 0)
 46 |         {
 47 |             print "You are trying to start a non-existant course!";
 48 |         }
 49 |         else
 50 |         {
 51 |             $coud = mysql_fetch_array($cd);
 52 |             $cdo =
 53 |                     mysql_query(
 54 |                             "SELECT * FROM coursesdone WHERE userid=$userid AND courseid={$_GET['cstart']}",
 55 |                             $c);
 56 |             if ($ir['money'] < $coud['crCOST'])
 57 |             {
 58 |                 print "You don't have enough money to start this course.";
 59 |                 $h->endpage();
 60 |                 exit;
 61 |             }
 62 |             if (mysql_num_rows($cdo) > 0)
 63 |             {
 64 |                 print "You have already done this course.";
 65 |                 $h->endpage();
 66 |                 exit;
 67 |             }
 68 |             mysql_query(
 69 |                     "UPDATE users SET course={$_GET['cstart']},cdays={$coud['crDAYS']},money=money-{$coud['crCOST']} WHERE userid=$userid",
 70 |                     $c);
 71 |             print
 72 |                     "You have started the {$coud['crNAME']}, it will take {$coud['crDAYS']} days to complete.";
 73 |         }
 74 |     }
 75 |     else
 76 |     {
 77 |         //list courses
 78 |         print "Here is a list of available courses.";
 79 |         $q = mysql_query("SELECT * FROM courses", $c);
 80 |         print
 81 |                 "<br /><table width=75%><tr style='background:gray;'><th>Course</th><th>Description</th><th>Cost</th><th>Take</th></tr>";
 82 |         while ($r = mysql_fetch_array($q))
 83 |         {
 84 |             $cdo =
 85 |                     mysql_query(
 86 |                             "SELECT * FROM coursesdone WHERE userid=$userid AND courseid={$r['crID']}",
 87 |                             $c);
 88 |             if (mysql_num_rows($cdo))
 89 |             {
 90 |                 $do = "<i>Done</i>";
 91 |             }
 92 |             else
 93 |             {
 94 |                 $do = "<a href='education.php?cstart={$r['crID']}'>Take</a>";
 95 |             }
 96 |             print
 97 |                     "<tr><td>{$r['crNAME']}</td><td>{$r['crDESC']}</td><td>\${$r['crCOST']}</td><td>$do</td></tr>";
 98 |         }
 99 |         print "</table>";
100 |     }
101 | }
102 | $h->endpage();
103 | 


--------------------------------------------------------------------------------
/advsearch.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm);
26 | $h->menuarea();
27 | if ($_POST['submit'])
28 | {
29 |     $levelmin = abs((int) $_POST['levelmin']);
30 |     $levelmax = abs((int) $_POST['levelmax']);
31 |     $levelmin_clause = "WHERE level >= '{$levelmin}'";
32 |     $levelmax_clause = " AND level <= '{$levelmax}'";
33 |     $nom = mysql_real_escape_string(stripslashes($_POST['name']), $c);
34 |     $gender =
35 |             in_array($_POST['gender'], array('Male', 'Female'), true)
36 |                     ? $_POST['gender'] : '';
37 |     $name_clause = ($nom) ? " AND username LIKE('%{$nom}%')" : "";
38 |     $gender_clause = ($gender) ? " AND gender = '{$gender}'" : "";
39 |     $house = abs((int) $_POST['house']);
40 |     $online = abs((int) $_POST['online']);
41 |     $dayo_min = abs((int) $_POST['daysmin']);
42 |     $dayo_max = abs((int) $_POST['daysmax']);
43 |     $house_clause = ($house) ? " AND maxwill = '{$house}'" : "";
44 |     $online_clause = ($online) ? " AND laston >= " . (time() - $online) : "";
45 |     $daysmin_clause = ($dayo_min) ? " AND daysold >= '{$dayo_min}'" : "";
46 |     $daysmax_clause = ($dayo_max) ? " AND daysold <= '{$dayo_max}'" : "";
47 |     $q =
48 |             mysql_query(
49 |                     "SELECT * FROM users $levelmin_clause$levelmax_clause$name_clause$gender_clause$house_clause$online_clause$daysmin_clause$daysmax_clause",
50 |                     $c);
51 |     print
52 |             mysql_num_rows($q)
53 |                     . " players found. <br />
54 | <table><tr style='background-color:gray;'><th>User</th><th>Level</th><th>Money</th></tr>";
55 |     while ($r = mysql_fetch_array($q))
56 |     {
57 |         print
58 |                 "<tr><td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a></td><td>{$r['level']}</td><td>\${$r['money']}</td></tr>";
59 |     }
60 |     print "</table>";
61 | }
62 | else
63 | {
64 |     print
65 |             <<<EOF
66 | <h3>Advanced search</h3>
67 | <span style="color: red;">*</span> is a required field.<br />
68 | <form action="advsearch.php" method="post">
69 | <input type="hidden" name="submit" value="1" />
70 | Name: <input type="text" name="name" /><br />
71 | Level: From: <span style="color: red;">*</span><input type="text" name="levelmin" value="1" /> To:
72 | <span style="color: red;">*</span> <input type="text" name="levelmax" value="100" /><br />
73 | Gender: <select name="gender" type="dropdown">
74 | <option value="0" selected="selected">Either</option>
75 | <option value="Male">Male</option>
76 | <option value="Female">Female</option>
77 | </select><br />
78 | House: <select name=house type=dropdown>
79 | <option value=0 selected>Any House</option>
80 | EOF;
81 |     $q = mysql_query("SELECT * FROM houses ORDER BY hWILL ASC", $c);
82 |     while ($r = mysql_fetch_array($q))
83 |     {
84 |         print "\n<option value='{$r['hWILL']}'>{$r['hNAME']}</option>";
85 |     }
86 |     print
87 |             <<<EOF
88 | </select><br />
89 | Days Old: From: <input type=text name=daysmin> To: <input type=text name=daysmax><br />
90 | <input type='submit' value='Go'></form>
91 | EOF;
92 | }
93 | $h->endpage();
94 | 


--------------------------------------------------------------------------------
/attackleave.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | session_start();
 4 | require "global_func.php";
 5 | if ($_SESSION['loggedin'] == 0)
 6 | {
 7 |     header("Location: login.php");
 8 |     exit;
 9 | }
10 | $userid = $_SESSION['userid'];
11 | require "header.php";
12 | $h = new headers;
13 | $h->startheaders();
14 | include "mysql.php";
15 | global $c;
16 | $is =
17 |         mysql_query(
18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
19 |                 $c) or die(mysql_error());
20 | $ir = mysql_fetch_array($is);
21 | check_level();
22 | $fm = money_formatter($ir['money']);
23 | $cm = money_formatter($ir['crystals'], '');
24 | $lv = date('F j, Y, g:i a', $ir['laston']);
25 | $h->userdata($ir, $lv, $fm, $cm, 0);
26 | $h->menuarea();
27 | 
28 | $_GET['ID'] = abs((int) $_GET['ID']);
29 | $_SESSION['attacking'] = 0;
30 | $od = mysql_query("SELECT * FROM users WHERE userid={$_GET['ID']}", $c);
31 | if ($_SESSION['attackwon'] != $_GET['ID'])
32 | {
33 |     die("Cheaters don't get anywhere.");
34 | }
35 | if (mysql_num_rows($od))
36 | {
37 |     $r = mysql_fetch_array($od);
38 |     if ($r['hp'] == 1)
39 |     {
40 |         print "What a cheater u are.";
41 |     }
42 |     else
43 |     {
44 |         print "You beat {$r['username']} and leave him on the ground.";
45 |         $qe = $r['level'] * $r['level'] * $r['level'];
46 |         $expgain = rand($qe / 4, $qe / 2);
47 |         $expperc = (int) ($expgain / $ir['exp_needed'] * 100);
48 |         print " and gained $expperc% EXP!";
49 |         mysql_query("UPDATE users SET exp=exp+$expgain WHERE userid=$userid",
50 |                 $c);
51 |         mysql_query("UPDATE users SET hp=1 WHERE userid={$r['userid']}", $c);
52 |         event_add($r['userid'],
53 |                 "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> attacked you and left you lying on the street.",
54 |                 $c);
55 | 
56 |         mysql_query(
57 |                 "UPDATE users SET hp=1,hospital=hospital+20+(rand()*20),hospreason='Attacked by <a href=\'viewuser.php?u={$userid}\'>{$ir['username']}</a>' WHERE userid={$r['userid']}",
58 |                 $c);
59 |         $atklog = mysql_escape_string($_SESSION['attacklog']);
60 |         mysql_query(
61 |                 "INSERT INTO attacklogs VALUES(NULL,$userid,{$_GET['ID']},'won',"
62 |                         . time() . ",$stole,'$atklog');", $c);
63 |         $_SESSION['attackwon'] = 0;
64 |         $bots = array(2477, 2479, 2480, 2481, 263, 264, 265);
65 |         $moneys =
66 |                 array(2477 => 80000, 2479 => 30000, 2480 => 30000,
67 |                         2481 => 30000, 263 => 10000, 264 => 10000,
68 |                         265 => 15000, 536 => 100000, 720 => 1400000,
69 |                         721 => 1400000, 722 => 1400000, 585 => 5000000,
70 |                         820 => 10000000);
71 |         if (in_array($r['userid'], $bots))
72 |         {
73 |             $qk =
74 |                     mysql_query(
75 |                             "SELECT * FROM challengesbeaten WHERE userid=$userid AND npcid={$r['userid']}",
76 |                             $c);
77 |             if (!mysql_num_rows($qk))
78 |             {
79 |                 $gain = $moneys[$r['userid']];
80 |                 mysql_query(
81 |                         "UPDATE users SET money=money+$gain WHERE userid=$userid",
82 |                         $c);
83 |                 mysql_query(
84 |                         "INSERT INTO challengesbeaten VALUES ($userid,{$r['userid']})",
85 |                         $c);
86 |                 print
87 |                         "<br /><br />Congrats, for beating the Challenge Bot {$r['username']}, you have earnt \$$gain!";
88 |             }
89 |         }
90 |     }
91 | }
92 | else
93 | {
94 |     print "You beat Mr. non-existant!";
95 | }
96 | $h->endpage();
97 | 


--------------------------------------------------------------------------------
/crons/cron_day.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | require_once(dirname(__FILE__) . "/../mysql.php");
  4 | require_once(dirname(__FILE__) . "/../global_func.php");
  5 | $cron_code = '4f155ea3c4a19a5d37420b1158111a78';
  6 | if ($argc == 2)
  7 | {
  8 |     if ($argv[1] != $cron_code)
  9 |     {
 10 |         exit;
 11 |     }
 12 | }
 13 | else if (!isset($_GET['code']) || $_GET['code'] !== $cron_code)
 14 | {
 15 |     exit;
 16 | }
 17 | mysql_query("UPDATE `fedjail` SET `fed_days` = `fed_days` - 1", $c);
 18 | $q = mysql_query("SELECT * FROM `fedjail` WHERE `fed_days` <= 0", $c);
 19 | $ids = array();
 20 | while ($r = mysql_fetch_assoc($q))
 21 | {
 22 |     $ids[] = $r['fed_userid'];
 23 | }
 24 | mysql_free_result($q);
 25 | if (count($ids) > 0)
 26 | {
 27 |     mysql_query(
 28 |             "UPDATE `users` SET `fedjail` = 0 WHERE `userid` IN("
 29 |                     . implode(",", $ids) . ")", $c);
 30 | }
 31 | mysql_query("DELETE FROM `fedjail` WHERE `fed_days` <= 0", $c);
 32 | $user_update_query =
 33 |         "UPDATE `users` SET 
 34 |          `daysold` = `daysold` + 1,
 35 |          `mailban` = `mailban` - IF(`mailban` > 0, 1, 0),
 36 |          `donatordays` = `donatordays` - IF(`donatordays` > 0, 1, 0),
 37 |          `cdays` = `cdays` - IF(`course` > 0, 1, 0),
 38 |          `bankmoney` = `bankmoney` + IF(`bankmoney` > 0, `bankmoney` / 50, 0),
 39 |          `cybermoney` = `cybermoney` + IF(`cybermoney` > 0, `cybermoney` / 100 * 7, 0)";
 40 | mysql_query($user_update_query, $c);
 41 | $q =
 42 |         mysql_query(
 43 |                 "SELECT `userid`, `course` FROM `users` WHERE `cdays` <= 0 AND `course` > 0",
 44 |                 $c);
 45 | $course_cache = array();
 46 | while ($r = mysql_fetch_assoc($q))
 47 | {
 48 |     if (!array_key_exists($r['course'], $course_cache))
 49 |     {
 50 |         $cd =
 51 |                 mysql_query(
 52 |                         "SELECT `crSTR`, `crGUARD`, `crLABOUR`, `crAGIL`, `crIQ`, `crNAME`
 53 |      				     FROM `courses`
 54 |                          WHERE `crID` = {$r['course']}", $c);
 55 |         $coud = mysql_fetch_assoc($cd);
 56 |         mysql_free_result($cd);
 57 |         $course_cache[$r['course']] = $coud;
 58 |     }
 59 |     else
 60 |     {
 61 |         $coud = $course_cache[$r['course']];
 62 |     }
 63 |     $userid = $r['userid'];
 64 |     mysql_query(
 65 |             "INSERT INTO `coursesdone` VALUES({$r['userid']}, {$r['course']})",
 66 |             $c);
 67 |     $upd = "";
 68 |     $ev = "";
 69 |     if ($coud['crSTR'] > 0)
 70 |     {
 71 |         $upd .= ", us.strength = us.strength + {$coud['crSTR']}";
 72 |         $ev .= ", {$coud['crSTR']} strength";
 73 |     }
 74 |     if ($coud['crGUARD'] > 0)
 75 |     {
 76 |         $upd .= ", us.guard = us.guard + {$coud['crGUARD']}";
 77 |         $ev .= ", {$coud['crGUARD']} guard";
 78 |     }
 79 |     if ($coud['crLABOUR'] > 0)
 80 |     {
 81 |         $upd .= ", us.labour = us.labour + {$coud['crLABOUR']}";
 82 |         $ev .= ", {$coud['crLABOUR']} labour";
 83 |     }
 84 |     if ($coud['crAGIL'] > 0)
 85 |     {
 86 |         $upd .= ", us.agility = us.agility + {$coud['crAGIL']}";
 87 |         $ev .= ", {$coud['crAGIL']} agility";
 88 |     }
 89 |     if ($coud['crIQ'] > 0)
 90 |     {
 91 |         $upd .= ", us.IQ = us.IQ + {$coud['crIQ']}";
 92 |         $ev .= ", {$coud['crIQ']} IQ";
 93 |     }
 94 |     $ev = substr($ev, 1);
 95 |     mysql_query(
 96 |             "UPDATE `users` AS `u`
 97 |                 INNER JOIN `userstats` AS `us` ON `u`.`userid` = `us`.`userid`
 98 |                 SET `u`.`course` = 0{$upd}
 99 |                 WHERE `u`.`userid` = {$userid}", $c);
100 |     event_add($userid,
101 |             "Congratulations, you completed the {$coud['crNAME']} and gained {$ev}!",
102 |             $c);
103 | }
104 | mysql_free_result($q);
105 | mysql_query("TRUNCATE TABLE `votes`", $c);
106 | 


--------------------------------------------------------------------------------
/itemuse.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $_GET['ID'] = abs((int) $_GET['ID']);
 28 | //Food
 29 | if (!$_GET['ID'])
 30 | {
 31 |     print "Invalid use of file";
 32 | }
 33 | else
 34 | {
 35 |     $i =
 36 |             mysql_query(
 37 |                     "SELECT iv.*,i.*,it.* FROM inventory iv LEFT JOIN items i ON iv.inv_itemid=i.itmid LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid WHERE iv.inv_id={$_GET['ID']} AND iv.inv_userid=$userid",
 38 |                     $c);
 39 |     if (mysql_num_rows($i) == 0)
 40 |     {
 41 |         print "Invalid item ID";
 42 |     }
 43 |     else
 44 |     {
 45 |         $r = mysql_fetch_array($i);
 46 |         if ($r['itmtypename'] == 'Food')
 47 |         {
 48 |             $f =
 49 |                     mysql_query(
 50 |                             "SELECT * FROM food WHERE item_id={$r['itmid']}",
 51 |                             $c);
 52 |             $fr = mysql_fetch_array($f);
 53 |             mysql_query(
 54 |                     "UPDATE inventory SET inv_qty=inv_qty-1 WHERE inv_id={$_GET['ID']}",
 55 |                     $c);
 56 |             mysql_query("DELETE FROM inventory WHERE inv_qty=0", $c);
 57 |             mysql_query(
 58 |                     "UPDATE users SET energy=energy+{$fr['energy']} WHERE userid=$userid");
 59 |             mysql_query(
 60 |                     "UPDATE users SET energy=maxenergy WHERE energy > maxenergy");
 61 |             print
 62 |                     "You cram a {$r['itmname']} into your mouth. You feel a bit of energy coming back to you.";
 63 |         }
 64 |         else if ($r['itmtypename'] == 'Medical')
 65 |         {
 66 |             $f =
 67 |                     mysql_query(
 68 |                             "SELECT * FROM medical WHERE item_id={$r['itmid']}",
 69 |                             $c);
 70 |             $fr = mysql_fetch_array($f);
 71 |             mysql_query(
 72 |                     "UPDATE inventory SET inv_qty=inv_qty-1 WHERE inv_id={$_GET['ID']}",
 73 |                     $c);
 74 |             mysql_query("DELETE FROM inventory WHERE inv_qty=0", $c);
 75 |             mysql_query(
 76 |                     "UPDATE users SET hp=hp+{$fr['health']} WHERE userid=$userid");
 77 |             mysql_query("UPDATE users SET hp=maxhp WHERE hp > maxhp");
 78 |             if ($r['itmname'] == 'Full Restore')
 79 |             {
 80 |                 mysql_query(
 81 |                         "UPDATE users SET energy=maxenergy,will=maxwill,brave=maxbrave WHERE userid=$userid",
 82 |                         $c);
 83 |             }
 84 |             if ($r['itmname'] == 'Will Potion')
 85 |             {
 86 |                 mysql_query(
 87 |                         "UPDATE users SET will=maxwill WHERE userid=$userid",
 88 |                         $c);
 89 |             }
 90 |             print
 91 |                     "You spray a {$r['itmname']} into your mouth. You feel a bit of health coming back to you.";
 92 |         }
 93 |         else
 94 |         {
 95 |             print "You cannot use this item.";
 96 |         }
 97 |     }
 98 | }
 99 | $h->endpage();
100 | 


--------------------------------------------------------------------------------
/gym.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $out = "";
 26 | $_GET['times'] = abs((int) $_GET['times']);
 27 | if (isset($_GET['train']))
 28 | {
 29 |     if ($_GET['train'] != "strength" && $_GET['train'] != "agility"
 30 |             && $_GET['train'] != "guard" && $_GET['train'] != "labour")
 31 |     {
 32 |         $h->userdata($ir, $lv, $fm, $cm);
 33 |         $h->menuarea();
 34 |         die("Abusers aren't allowed.");
 35 |     }
 36 |     $tgain = 0;
 37 |     for ($i = 1; $i <= $_GET['times'] && $ir['energy'] > 0; $i++)
 38 |     {
 39 |         if ($ir['energy'] > 0)
 40 |         {
 41 |             $gain =
 42 |                     rand(1, 3) / rand(800, 1000) * rand(800, 1000)
 43 |                             * (($ir['will'] + 20) / 150);
 44 |             $tgain += $gain;
 45 |             if ($_GET['train'] == "IQ")
 46 |             {
 47 |                 $gain /= 100;
 48 |             }
 49 |             $ir[$_GET['train']] += $gain;
 50 |             $egain = $gain / 10;
 51 |             $ts = $ir[$_GET['train']];
 52 |             $st = $_GET['train'];
 53 | 
 54 |             mysql_query(
 55 |                     "UPDATE userstats SET $st=$st+" . $gain
 56 |                             . " WHERE userid=$userid", $c)
 57 |                     or die(
 58 |                             "UPDATE userstats SET $st=$st+$gain,energy=energy-1,exp=exp+$egain WHERE userid=$userid<br />"
 59 |                                     . mysql_error());
 60 |             $wu = (int) (rand(1, 3));
 61 |             if ($ir['will'] >= $wu)
 62 |             {
 63 |                 $ir['will'] -= $wu;
 64 |                 mysql_query(
 65 |                         "UPDATE users SET energy=energy-1,exp=exp+$egain,will=will-$wu WHERE userid=$userid",
 66 |                         $c);
 67 |             }
 68 |             else
 69 |             {
 70 |                 $ir['will'] = 0;
 71 |                 mysql_query(
 72 |                         "UPDATE users SET energy=energy-1,exp=exp+$egain,will=0 WHERE userid=$userid",
 73 |                         $c);
 74 |             }
 75 |             $ir['energy'] -= 1;
 76 |             $ir['exp'] += $egain;
 77 | 
 78 |         }
 79 |         else
 80 |         {
 81 |             $out = "You do not have enough energy to train.";
 82 |         }
 83 |     }
 84 |     $stat = $ir[$st];
 85 |     $i--;
 86 |     $out =
 87 |             "You begin training your $st.<br />
 88 | You have gained $tgain $st by training it $i times.<br />
 89 | You now have $stat $st and {$ir['energy']} energy left.<br /><br />";
 90 | 
 91 | }
 92 | else
 93 | {
 94 |     $out = "<h3>Gym: Main Lobby<h3>";
 95 | }
 96 | $h->userdata($ir, $lv, $fm, $cm);
 97 | $h->menuarea();
 98 | print $out;
 99 | print
100 |         "Enter the amount of times you wish to train and choose the stat to train.<br />
101 | You can train up to {$ir['energy']} times.<br /><form action='gym.php' method='get'>
102 | <input type='text' name='times' value='1' /><select type='dropdown' name='train'>
103 | <option value='strength'>Strength</option>
104 | <option value='agility'>Agility</option>
105 | <option value='labour'>Labour</option>
106 | <option value='guard'>Guard</option></select><br />
107 | <input type='submit' value='Train!' /></form>";
108 | 
109 | $h->endpage();
110 | 


--------------------------------------------------------------------------------
/attackmug.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm, 0);
 26 | $h->menuarea();
 27 | 
 28 | $_GET['ID'] = abs((int) $_GET['ID']);
 29 | $_SESSION['attacking'] = 0;
 30 | $od = mysql_query("SELECT * FROM users WHERE userid={$_GET['ID']}", $c);
 31 | if ($_SESSION['attackwon'] != $_GET['ID'])
 32 | {
 33 |     die("Cheaters don't get anywhere.");
 34 | }
 35 | if (mysql_num_rows($od))
 36 | {
 37 |     $r = mysql_fetch_array($od);
 38 |     if ($r['hp'] == 1)
 39 |     {
 40 |         print "What a cheater u are.";
 41 |     }
 42 |     else
 43 |     {
 44 |         $stole = (int) (rand($r['money'] / 500, $r['money'] / 20));
 45 |         print "You beat {$r['username']} and stole \$$stole";
 46 |         $qe = $r['level'] * $r['level'] * $r['level'];
 47 |         $expgain = rand($qe / 4, $qe / 2);
 48 |         $expperc = (int) ($expgain / $ir['exp_needed'] * 100);
 49 |         print " and gained $expperc% EXP!";
 50 |         mysql_query(
 51 |                 "UPDATE users SET exp=exp+$expgain,money=money+$stole WHERE userid=$userid",
 52 |                 $c);
 53 |         mysql_query(
 54 |                 "UPDATE users SET hp=1,money=money-$stole WHERE userid={$r['userid']}",
 55 |                 $c);
 56 |         event_add($r['userid'],
 57 |                 "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> attacked you and stole $stole.",
 58 |                 $c);
 59 | 
 60 |         mysql_query(
 61 |                 "UPDATE users SET hp=1,hospital=hospital+20+(rand()*20),hospreason='Attacked by <a href=\'viewuser.php?u={$userid}\'>{$ir['username']}</a>' WHERE userid={$r['userid']}",
 62 |                 $c);
 63 |         $atklog = mysql_escape_string($_SESSION['attacklog']);
 64 |         mysql_query(
 65 |                 "INSERT INTO attacklogs VALUES(NULL,$userid,{$_GET['ID']},'won',"
 66 |                         . time() . ",$stole,'$atklog');", $c);
 67 |         $_SESSION['attackwon'] = 0;
 68 |         $bots = array(2477, 2479, 2480, 2481, 263, 264, 265);
 69 |         $moneys =
 70 |                 array(2477 => 80000, 2479 => 30000, 2480 => 30000,
 71 |                         2481 => 30000, 263 => 10000, 264 => 10000,
 72 |                         265 => 15000, 536 => 100000, 720 => 1400000,
 73 |                         721 => 1400000, 722 => 1400000, 585 => 5000000,
 74 |                         820 => 10000000);
 75 |         if (in_array($r['userid'], $bots))
 76 |         {
 77 |             $qk =
 78 |                     mysql_query(
 79 |                             "SELECT * FROM challengesbeaten WHERE userid=$userid AND npcid={$r['userid']}",
 80 |                             $c);
 81 |             if (!mysql_num_rows($qk))
 82 |             {
 83 |                 $gain = $moneys[$r['userid']];
 84 |                 mysql_query(
 85 |                         "UPDATE users SET money=money+$gain WHERE userid=$userid",
 86 |                         $c);
 87 |                 mysql_query(
 88 |                         "INSERT INTO challengesbeaten VALUES ($userid,{$r['userid']})",
 89 |                         $c);
 90 |                 print
 91 |                         "<br /><br />Congrats, for beating the Challenge Bot {$r['username']}, you have earnt \$$gain!";
 92 |             }
 93 |         }
 94 |     }
 95 | }
 96 | else
 97 | {
 98 |     print "You beat Mr. non-existant!";
 99 | }
100 | $h->endpage();
101 | 


--------------------------------------------------------------------------------
/stats.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | // Basic Stats (all users)
 28 | $q =
 29 |         mysql_query(
 30 |                 "SELECT COUNT(`userid`) AS `c_users`,
 31 | 				 SUM(`money`) AS `s_money`,
 32 | 				 SUM(`crystals`) AS `s_crystals`
 33 |                  FROM `users`", $c);
 34 | $mem_info = mysql_fetch_assoc($q);
 35 | $membs = $mem_info['c_users'];
 36 | $total = $mem_info['s_money'];
 37 | $avg = (int) ($total / ($membs > 1 ? $membs : 1));
 38 | $totalc = $mem_info['s_crystals'];
 39 | $avgc = (int) ($totalc / ($membs > 1 ? $membs : 1));
 40 | mysql_free_result($q);
 41 | $q =
 42 |         mysql_query(
 43 |                 "SELECT COUNT(`userid`) AS `c_users`,
 44 |                  SUM(`bankmoney`) AS `s_bank`
 45 |                  FROM `users`
 46 |                  WHERE `bankmoney` > -1", $c);
 47 | $bank_info = mysql_fetch_assoc($q);
 48 | $banks = $bank_info['c_users'];
 49 | $totalb = $bank_info['s_bank'];
 50 | $avgb = (int) ($totalb / ($banks > 0 ? $banks : 1));
 51 | mysql_free_result($q);
 52 | $q =
 53 |         mysql_query(
 54 |                 "SELECT COUNT(`userid`)
 55 |                  FROM `users`
 56 |                  WHERE `gender` = 'Male'", $c);
 57 | $male = mysql_result($q, 0, 0);
 58 | mysql_free_result($q);
 59 | $q =
 60 |         mysql_query(
 61 |                 "SELECT COUNT(`userid`)
 62 |                  FROM `users`
 63 |                  WHERE `gender` = 'Female'", $c);
 64 | $fem = mysql_result($q, 0, 0);
 65 | mysql_free_result($q);
 66 | 
 67 | $q = mysql_query("SELECT SUM(`inv_qty`)
 68 | 				 FROM `inventory`", $c);
 69 | $totali =(int) mysql_result($q, 0, 0);
 70 | mysql_free_result($q);
 71 | $q = mysql_query("SELECT COUNT(`mail_id`)
 72 | 				 FROM `mail`", $c);
 73 | $mail = mysql_result($q, 0, 0);
 74 | mysql_free_result($q);
 75 | $q = mysql_query("SELECT COUNT(`evID`)
 76 | 				 FROM `events`", $c);
 77 | $events = mysql_result($q, 0, 0);
 78 | mysql_free_result($q);
 79 | echo "<h3>Country Statistics</h3>
 80 | You step into the Statistics Department and login to the service. You see some stats that interest you.<br />
 81 | <table width='75%' cellspacing='1' class='table'>
 82 | 	<tr>
 83 | 		<th>Users</th>
 84 | 		<th>Money and Crystals</th>
 85 | 	</tr>
 86 | 	<tr>
 87 | 		<td>
 88 | 			There are currently $membs {$set['game_name']} players,
 89 |                 $male males and $fem females.
 90 |         </td>
 91 |         <td>
 92 | 			Amount of cash in circulation: " . money_formatter($total)
 93 |         . ". <br />
 94 | 			The average player has: " . money_formatter($avg)
 95 |         . ". <br />
 96 | 			Amount of cash in banks: " . money_formatter($totalb)
 97 |         . ". <br />
 98 | 			Amount of players with bank accounts: $banks<br />
 99 | 			The average player has in their bank accnt: "
100 |         . money_formatter($avgb)
101 |         . ". <br />
102 | 			Amount of crystals in circulation: "
103 |         . money_formatter($totalc, "")
104 |         . ". <br />
105 | 			The average player has: " . money_formatter($avgc, "")
106 |         . " crystals.
107 |         </td>
108 |     </tr>
109 | 	<tr>
110 | 		<th>Mails/Events</th>
111 | 		<th>Items</th>
112 | 	</tr>
113 | 	<tr>
114 | 		<td>
115 | 			" . money_formatter($mail, "") . " mails and "
116 |         . money_formatter($events, "")
117 |         . " events have been sent.
118 |         </td>
119 |         <td>
120 | 			There are currently " . money_formatter($totali, "")
121 |         . " items in circulation.
122 |         </td>
123 |     </tr>
124 |  </table>";
125 | $h->endpage();
126 | 


--------------------------------------------------------------------------------
/sendcash.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $_GET['ID'] = abs((int) $_GET['ID']);
 28 | $_POST['money'] = abs((int) $_POST['money']);
 29 | if (!((int) $_GET['ID']))
 30 | {
 31 |     print "Invalid User ID";
 32 | }
 33 | else if ($_GET['ID'] == $userid)
 34 | {
 35 |     print "Haha, what does sending money to yourself do anyway?";
 36 | }
 37 | else
 38 | {
 39 |     if ((int) $_POST['money'])
 40 |     {
 41 |         if ($_POST['money'] > $ir['money'])
 42 |         {
 43 |             print "Die j00 abuser.";
 44 |         }
 45 |         else
 46 |         {
 47 |             mysql_query(
 48 |                     "UPDATE users SET money=money-{$_POST['money']} WHERE userid=$userid",
 49 |                     $c);
 50 |             mysql_query(
 51 |                     "UPDATE users SET money=money+{$_POST['money']} WHERE userid={$_GET['ID']}",
 52 |                     $c);
 53 |             print "You sent \${$_POST['money']} to ID {$_GET['ID']}.";
 54 |             event_add($_GET['ID'],
 55 |                     "You received \${$_POST['money']} from {$ir['username']}.",
 56 |                     $c);
 57 |             $it =
 58 |                     mysql_query(
 59 |                             "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid={$_GET['ID']}",
 60 |                             $c) or die(mysql_error());
 61 |             $er = mysql_fetch_array($it);
 62 |             mysql_query(
 63 |                     "INSERT INTO cashxferlogs VALUES(NULL, $userid, {$_GET['ID']}, {$_POST['money']}, "
 64 |                             . time()
 65 |                             . ", '{$ir['lastip']}', '{$er['lastip']}')", $c);
 66 |         }
 67 |     }
 68 |     else
 69 |     {
 70 |         print
 71 |                 "<h3> Sending Money</h3>
 72 | You are sending money to ID: <b>{$_GET['ID']}</b>.
 73 | <form action='sendcash.php?ID={$_GET['ID']}' method='post'>
 74 | Amnt: <input type='text' name='money' /><br />
 75 | <input type='submit' value='Send' /></form>";
 76 |         print
 77 |                 "<h3>Latest 5 Transfers</h3>
 78 | <table width=75% border=2> <tr style='background:gray'>  <th>Time</th> <th>User From</th> <th>User To</th> <th>Amount</th> </tr>";
 79 |         $q =
 80 |                 mysql_query(
 81 |                         "SELECT cx.*,u1.username as sender, u2.username as sent FROM cashxferlogs cx LEFT JOIN users u1 ON cx.cxFROM=u1.userid LEFT JOIN users u2 ON cx.cxTO=u2.userid WHERE cx.cxFROM=$userid ORDER BY cx.cxTIME DESC LIMIT 5",
 82 |                         $c)
 83 |                 or die(
 84 |                         mysql_error() . "<br />"
 85 |                                 . "SELECT cx.*,u1.username as sender, u2.username as sent FROM cashxferlogs cx LEFT JOIN users u1 ON cx.cxFROM=u1.userid LEFT JOIN users u2 ON cx.cxTO=u2.userid WHERE cx.cxFROM=$userid ORDER BY cx.cxTIME DESC LIMIT 5");
 86 |         while ($r = mysql_fetch_array($q))
 87 |         {
 88 |             if ($r['cxFROMIP'] == $r['cxTOIP'])
 89 |             {
 90 |                 $m = "<span style='color:red;font-weight:800'>MULTI</span>";
 91 |             }
 92 |             else
 93 |             {
 94 |                 $m = "";
 95 |             }
 96 |             print
 97 |                     "<tr> <td>" . date("F j, Y, g:i:s a", $r['cxTIME'])
 98 |                             . "</td><td>{$r['sender']} [{$r['cxFROM']}] </td><td>{$r['sent']} [{$r['cxTO']}] </td> <td> \${$r['cxAMOUNT']}</td> </tr>";
 99 |         }
100 |         print "</table>";
101 |     }
102 | }
103 | $h->endpage();
104 | 


--------------------------------------------------------------------------------
/itemsend.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | //itemsend
 28 | if ($_GET['qty'] && $_GET['user'])
 29 | {
 30 |     $id =
 31 |             mysql_query(
 32 |                     "SELECT iv.*,it.* FROM inventory iv LEFT JOIN items it ON iv.inv_itemid=it.itmid WHERE iv.inv_id={$_GET['ID']} AND iv.inv_userid=$userid LIMIT 1",
 33 |                     $c);
 34 |     if (mysql_num_rows($id) == 0)
 35 |     {
 36 |         print "Invalid item ID";
 37 |     }
 38 |     else
 39 |     {
 40 |         $r = mysql_fetch_array($id);
 41 |         $m =
 42 |                 mysql_query(
 43 |                         "SELECT * FROM users WHERE userid={$_GET['user']} LIMIT 1",
 44 |                         $c);
 45 |         if ($_GET['qty'] > $r['inv_qty'])
 46 |         {
 47 |             print "You are trying to send more than you have!";
 48 |         }
 49 |         else if ($_GET['qty'] <= 0)
 50 |         {
 51 |             print "You know, I'm not dumb, j00 cheating hacker.";
 52 |         }
 53 |         else if (mysql_num_rows($m) == 0)
 54 |         {
 55 |             print "You are trying to send to an invalid user!";
 56 |         }
 57 |         else
 58 |         {
 59 |             $rm = mysql_fetch_array($m);
 60 |             //are we sending it all
 61 |             if ($_GET['qty'] == $r['inv_qty'])
 62 |             {
 63 |                 //just give them possession of the item
 64 |                 mysql_query(
 65 |                         "UPDATE inventory SET inv_userid={$_GET['user']} WHERE inv_id={$_GET['ID']} LIMIT 1",
 66 |                         $c);
 67 | 
 68 |             }
 69 |             else
 70 |             {
 71 |                 //create seperate
 72 |                 mysql_query(
 73 |                         "INSERT INTO inventory VALUES(NULL,'{$r['inv_itemid']}',{$_GET['user']},{$_GET['qty']});",
 74 |                         $c);
 75 |                 mysql_query(
 76 |                         "UPDATE inventory SET inv_qty=inv_qty-{$_GET['qty']} WHERE inv_id={$_GET['ID']} LIMIT 1;",
 77 |                         $c);
 78 |             }
 79 |             print
 80 |                     "You sent {$_GET['qty']} {$r['itmname']}(s) to {$rm['username']}";
 81 |             event_add($_GET['user'],
 82 |                     "You received {$_GET['qty']} {$r['itmname']}(s) from <a href='viewuser.php?u=$userid'>{$ir['username']}</a>",
 83 |                     $c);
 84 |             mysql_query(
 85 |                     "INSERT INTO itemxferlogs VALUES(NULL,$userid,{$_GET['user']},{$r['itmid']},{$_GET['qty']},"
 86 |                             . time() . ")", $c);
 87 |         }
 88 |     }
 89 | }
 90 | else if ($_GET['ID'])
 91 | {
 92 |     $id =
 93 |             mysql_query(
 94 |                     "SELECT iv.*,it.* FROM inventory iv LEFT JOIN items it ON iv.inv_itemid=it.itmid WHERE iv.inv_id={$_GET['ID']} AND iv.inv_userid=$userid LIMIT 1",
 95 |                     $c);
 96 |     if (mysql_num_rows($id) == 0)
 97 |     {
 98 |         print "Invalid item ID";
 99 |     }
100 |     else
101 |     {
102 |         $r = mysql_fetch_array($id);
103 |         print
104 |                 "<b>Enter who you want to send {$r['itmname']} to and how many you want to send. You have {$r['inv_qty']} to send.</b><br />
105 | <form action='itemsend.php' method='get'>
106 | <input type='hidden' name='ID' value='{$_GET['ID']}' />User ID: <input type='text' name='user' value='' /><br />
107 | Quantity: <input type='text' name='qty' value='' /><br />
108 | <input type='submit' value='Send Items (no prompt so be sure!' /></form>";
109 |     }
110 | }
111 | else
112 | {
113 |     print "Invalid use of file.";
114 | }
115 | $h->endpage();
116 | 


--------------------------------------------------------------------------------
/hirespy.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | if ($ir['user_level'] != 2)
 28 | {
 29 |     die("");
 30 | }
 31 | $_POST['ID'] = abs((int) $_POST['ID']);
 32 | $_GET['ID'] = abs((int) $_GET['ID']);
 33 | if ($_POST['ID'])
 34 | {
 35 |     $q =
 36 |             mysql_query(
 37 |                     "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid={$_POST['ID']}",
 38 |                     $c);
 39 |     $r = mysql_fetch_array($q);
 40 |     if ($r['user_level'] == 2)
 41 |     {
 42 |         print
 43 |                 "The spy never came back. It was rumoured he was attacked by {$r['username']} and pushed off a cliff.";
 44 |     }
 45 |     else
 46 |     {
 47 |         $payment = $r['level'] * 1000;
 48 |         mysql_query(
 49 |                 "UPDATE users SET money=money-$payment WHERE userid=$userid",
 50 |                 $c);
 51 |         $exp =
 52 |                 (int) ($r['exp']
 53 |                         / (($r['level'] + 1) * ($r['level'] + 1)
 54 |                                 * ($r['level'] + 1) * 2) * 100);
 55 |         print
 56 |                 "You have hired a spy to get information on <b>{$r['username']}</b> at the cost of \$$payment. Here is the info he retrieved:<br />
 57 | Strength: {$r['strength']}<br />
 58 | Agility: {$r['agility']}<br />
 59 | Guard: {$r['guard']}<br />
 60 | Labour: {$r['labour']}<br />
 61 | IQ: {$r['IQ']}<br />
 62 | Exp: $exp%<br />
 63 | Here is his/her inventory.<br />";
 64 |         $inv =
 65 |                 mysql_query(
 66 |                         "SELECT iv.*,i.*,it.* FROM inventory iv LEFT JOIN items i ON iv.inv_itemid=i.itmid LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid WHERE iv.inv_userid={$r['userid']}",
 67 |                         $c);
 68 |         if (mysql_num_rows($inv) == 0)
 69 |         {
 70 |             print "<b>This person has no items!</b>";
 71 |         }
 72 |         else
 73 |         {
 74 |             print
 75 |                     "<b>His/her items are listed below.</b><br />
 76 | <table width=100%><tr style='background-color:gray;'><th>Item</th><th>Sell Value</th><th>Total Sell Value</th></tr>";
 77 |             while ($i = mysql_fetch_array($inv))
 78 |             {
 79 |                 print "<tr><td>{$i['itmname']}";
 80 |                 if ($i['inv_qty'] > 1)
 81 |                 {
 82 |                     print "&nbsp;x{$i['inv_qty']}";
 83 |                 }
 84 |                 print "</td><td>\${$i['itmsellprice']}</td><td>";
 85 |                 print "$" . ($i['itmsellprice'] * $i['inv_qty']);
 86 |                 print "</td></tr>";
 87 |             }
 88 |             print "</table>";
 89 |         }
 90 |     }
 91 | }
 92 | else
 93 | {
 94 |     $q =
 95 |             mysql_query(
 96 |                     "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid={$_GET['ID']}",
 97 |                     $c);
 98 |     if (mysql_num_rows($q) == 0)
 99 |     {
100 |         print "This user does not exist.";
101 |     }
102 |     else
103 |     {
104 |         $r = mysql_fetch_array($q);
105 |         $payment = $r['level'] * 1000;
106 |         print
107 |                 "You are hiring a spy to spy on <b>{$r['username']}</b> at the cost of \$$payment.<br />";
108 |         if ($ir['money'] >= $payment)
109 |         {
110 |             print
111 |                     "<form action='hirespy.php' method='post'><input type='hidden' name='ID' value='{$_GET['ID']}' /><input type='submit' value='Hire' /></form>";
112 |         }
113 |         else
114 |         {
115 |             print "You don't have enough money!";
116 |         }
117 |     }
118 | }
119 | 
120 | $h->endpage();
121 | 


--------------------------------------------------------------------------------
/crystaltemple.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | if (!$_GET['spend'])
 28 | {
 29 |     print
 30 |             "Welcome to the crystal temple!<br />
 31 | You have <b>{$ir['crystals']}</b> crystals.<br />
 32 | What would you like to spend your crystals on?<br />
 33 | <br />
 34 | <a href='crystaltemple.php?spend=refill'>Energy Refill - 12 Crystals</a><br />
 35 | <a href='crystaltemple.php?spend=IQ'>IQ - 5 IQ per crystal</a><br />
 36 | <a href='crystaltemple.php?spend=money'>Money - \$200 per crystal</a><br />";
 37 | }
 38 | else
 39 | {
 40 |     if ($_GET['spend'] == 'refill')
 41 |     {
 42 |         if ($ir['crystals'] < 12)
 43 |         {
 44 |             print "You don't have enough crystals!";
 45 |         }
 46 |         else if ($ir['energy'] == $ir['maxenergy'])
 47 |         {
 48 |             print "You already have full energy.";
 49 |         }
 50 |         else
 51 |         {
 52 |             mysql_query(
 53 |                     "UPDATE users SET energy=maxenergy,crystals=crystals-12 WHERE userid=$userid",
 54 |                     $c);
 55 |             print "You have paid 12 crystals to refill your energy bar.";
 56 |         }
 57 |     }
 58 |     else if ($_GET['spend'] == 'IQ')
 59 |     {
 60 |         print
 61 |                 "Type in the amount of crystals you want to swap for IQ.<br />
 62 | You have <b>{$ir['crystals']}</b> crystals.<br />
 63 | One crystal = 5 IQ.<form action='crystaltemple.php?spend=IQ2' method='post'><input type='text' name='crystals' /><br /><input type='submit' value='Swap' /></form>";
 64 |     }
 65 |     else if ($_GET['spend'] == 'IQ2')
 66 |     {
 67 |         $_POST['crystals'] = (int) $_POST['crystals'];
 68 |         if ($_POST['crystals'] <= 0 || $_POST['crystals'] > $ir['crystals'])
 69 |         {
 70 |             print
 71 |                     "Error, you either do not have enough crystals or did not fill out the form.<br />
 72 | <a href='crystaltemple.php?spend=IQ'>Back</a>";
 73 |         }
 74 |         else
 75 |         {
 76 |             $iqgain = $_POST['crystals'] * 5;
 77 |             mysql_query(
 78 |                     "UPDATE users SET crystals=crystals-{$_POST['crystals']} WHERE userid=$userid",
 79 |                     $c);
 80 |             mysql_query(
 81 |                     "UPDATE userstats SET IQ=IQ+$iqgain WHERE userid=$userid",
 82 |                     $c);
 83 |             print "You traded {$_POST['crystals']} crystals for $iqgain IQ.";
 84 |         }
 85 |     }
 86 |     else if ($_GET['spend'] == 'money')
 87 |     {
 88 |         print
 89 |                 "Type in the amount of crystals you want to swap for \$\$\$.<br />
 90 | You have <b>{$ir['crystals']}</b> crystals.<br />
 91 | One crystal = \$200.<form action='crystaltemple.php?spend=money2' method='post'><input type='text' name='crystals' /><br /><input type='submit' value='Swap' /></form>";
 92 |     }
 93 |     else if ($_GET['spend'] == 'money2')
 94 |     {
 95 |         $_POST['crystals'] = (int) $_POST['crystals'];
 96 |         if ($_POST['crystals'] <= 0 || $_POST['crystals'] > $ir['crystals'])
 97 |         {
 98 |             print
 99 |                     "Error, you either do not have enough crystals or did not fill out the form.<br />
100 | <a href='crystaltemple.php?spend=money'>Back</a>";
101 |         }
102 |         else
103 |         {
104 |             $iqgain = $_POST['crystals'] * 200;
105 |             mysql_query(
106 |                     "UPDATE users SET crystals=crystals-{$_POST['crystals']},money=money+$iqgain WHERE userid=$userid",
107 |                     $c);
108 |             print "You traded {$_POST['crystals']} crystals for \$$iqgain.";
109 |         }
110 |     }
111 | }
112 | 
113 | $h->endpage();
114 | 


--------------------------------------------------------------------------------
/bank.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | print "<h3>Bank</h3>";
 28 | if ($ir['bankmoney'] > -1)
 29 | {
 30 |     switch ($_GET['action'])
 31 |     {
 32 |     case "deposit":
 33 |         deposit();
 34 |         break;
 35 | 
 36 |     case "withdraw":
 37 |         withdraw();
 38 |         break;
 39 | 
 40 |     default:
 41 |         index();
 42 |         break;
 43 |     }
 44 | 
 45 | }
 46 | else
 47 | {
 48 |     if (isset($_GET['buy']))
 49 |     {
 50 |         if ($ir['money'] > 49999)
 51 |         {
 52 |             print
 53 |                     "Congratulations, you bought a bank account for \$50,000!<br />
 54 | <a href='bank.php'>Start using my account</a>";
 55 |             mysql_query(
 56 |                     "UPDATE users SET money=money-50000,bankmoney=0 WHERE userid=$userid",
 57 |                     $c);
 58 |         }
 59 |         else
 60 |         {
 61 |             print
 62 |                     "You do not have enough money to open an account.
 63 | <a href='explore.php'>Back to town...</a>";
 64 |         }
 65 |     }
 66 |     else
 67 |     {
 68 |         print
 69 |                 "Open a bank account today, just \$50,000!<br />
 70 | <a href='bank.php?buy'>&gt; Yes, sign me up!</a>";
 71 |     }
 72 | }
 73 | 
 74 | function index()
 75 | {
 76 |     global $ir, $c, $userid, $h;
 77 |     print
 78 |             "\n<b>You currently have \${$ir['bankmoney']} in the bank.</b><br />
 79 | At the end of each day, your bank balance will go up by 2%.<br />
 80 | <table width='75%' border='2'> <tr> <td width='50%'><b>Deposit Money</b><br />
 81 | It will cost you 15% of the money you deposit, rounded up. The maximum fee is \$3,000.<form action='bank.php?action=deposit' method='post'>
 82 | Amount: <input type='text' name='deposit' value='{$ir['money']}' /><br />
 83 | <input type='submit' value='Deposit' /></form></td> <td>
 84 | <b>Withdraw Money</b><br />
 85 | There is no fee on withdrawals.<form action='bank.php?action=withdraw' method='post'>
 86 | Amount: <input type='text' name='withdraw' value='{$ir['bankmoney']}' /><br />
 87 | <input type='submit' value='Withdraw' /></form></td> </tr> </table>";
 88 | }
 89 | 
 90 | function deposit()
 91 | {
 92 |     global $ir, $c, $userid, $h;
 93 |     $_POST['deposit'] = abs((int) $_POST['deposit']);
 94 |     if ($_POST['deposit'] > $ir['money'])
 95 |     {
 96 |         print "You do not have enough money to deposit this amount.";
 97 |     }
 98 |     else
 99 |     {
100 |         $fee = ceil($_POST['deposit'] * 15 / 100);
101 |         if ($fee > 3000)
102 |         {
103 |             $fee = 3000;
104 |         }
105 |         $gain = $_POST['deposit'] - $fee;
106 |         $ir['bankmoney'] += $gain;
107 |         mysql_query(
108 |                 "UPDATE users SET bankmoney=bankmoney+$gain, money=money-{$_POST['deposit']} where userid=$userid",
109 |                 $c);
110 |         print
111 |                 "You hand over \${$_POST['deposit']} to be deposited, <br />
112 | after the fee is taken (\$$fee), \$$gain is added to your account. <br />
113 | <b>You now have \${$ir['bankmoney']} in the bank.</b><br />
114 | <a href='bank.php'>&gt; Back</a>";
115 |     }
116 | }
117 | 
118 | function withdraw()
119 | {
120 |     global $ir, $c, $userid, $h;
121 |     $_POST['withdraw'] = abs((int) $_POST['withdraw']);
122 |     if ($_POST['withdraw'] > $ir['bankmoney'])
123 |     {
124 |         print "You do not have enough banked money to withdraw this amount.";
125 |     }
126 |     else
127 |     {
128 | 
129 |         $gain = $_POST['withdraw'];
130 |         $ir['bankmoney'] -= $gain;
131 |         mysql_query(
132 |                 "UPDATE users SET bankmoney=bankmoney-$gain, money=money+$gain where userid=$userid",
133 |                 $c);
134 |         print
135 |                 "You ask to withdraw $gain, <br />
136 | the banking lady grudgingly hands it over. <br />
137 | <b>You now have \${$ir['bankmoney']} in the bank.</b><br />
138 | <a href='bank.php'>&gt; Back</a>";
139 |     }
140 | }
141 | $h->endpage();
142 | 


--------------------------------------------------------------------------------
/register.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "mysql.php";
  5 | require "global_func.php";
  6 | print 
  7 |         <<<EOF
  8 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  9 | <html xmlns="http://www.w3.org/1999/xhtml">
 10 | <head>
 11 | <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
 12 | <link href="css/game.css" type="text/css" rel="stylesheet" />
 13 | <title>breakthenet</title>
 14 | </head>
 15 | <body onload="getme();" bgcolor="#C3C3C3">
 16 | <img src="logo.png" alt="Your Game Logo" />
 17 | <br />
 18 | EOF;
 19 | $ip = ($_SERVER['REMOTE_ADDR']);
 20 | if (file_exists('ipbans/' . $ip))
 21 | {
 22 |     die(
 23 |             "<b><span style='color: red; font-size: 120%'>
 24 |             Your IP has been banned, there is no way around this.
 25 |             </span></b>
 26 |             </body></html>");
 27 | }
 28 | if ($_POST['username'])
 29 | {
 30 |     $sm = 1000;
 31 |     if ($_POST['promo'] == "Your Promo Code Here")
 32 |     {
 33 |         $sm += 1000;
 34 |     }
 35 |     $username = $_POST['username'];
 36 |     $username =
 37 |             mysql_real_escape_string(
 38 |                     htmlentities(stripslashes($username), ENT_QUOTES,
 39 |                             'ISO-8859-1'), $c);
 40 |     $q = mysql_query("SELECT * FROM users WHERE username='{$username}'", $c);
 41 |     if (mysql_num_rows($q))
 42 |     {
 43 |         print "Username already in use. Choose another.";
 44 |     }
 45 |     else if ($_POST['password'] != $_POST['cpassword'])
 46 |     {
 47 |         print "The passwords did not match, go back and try again.";
 48 |     }
 49 |     else
 50 |     {
 51 |         $_POST['ref'] = abs((int) $_POST['ref']);
 52 |         $ip = $_SERVER['REMOTE_ADDR'];
 53 |         if ($_POST['ref'])
 54 |         {
 55 |             $q =
 56 |                     mysql_query(
 57 |                             "SELECT `lastip`
 58 |                              FROM `users`
 59 |                              WHERE `userid` = {$_POST['ref']}", $c);
 60 |             if (mysql_num_rows($q) == 0)
 61 |             {
 62 |                 mysql_free_result($q);
 63 |                 echo "Referrer does not exist.<br />
 64 | 				&gt; <a href='register.php'>Back</a>";
 65 |                 die('</body></html>');
 66 |             }
 67 |             $rem_IP = mysql_result($q, 0, 0);
 68 |             mysql_free_result($q);
 69 |             if ($rem_IP == $ip)
 70 |             {
 71 |                 echo "No creating referral multies.<br />
 72 | 				&gt; <a href='register.php'>Back</a>";
 73 |                 die('</body></html>');
 74 |             }
 75 |         }
 76 |         mysql_query(
 77 |                 "INSERT INTO users (username, login_name, userpass, level, money, crystals, donatordays, user_level, energy, maxenergy, will, maxwill, brave, maxbrave, hp, maxhp, location, gender, signedup, email, bankmoney, lastip) VALUES( '{$username}', '{$username}', md5('{$_POST['password']}'), 1, $sm, 0, 0, 1, 12, 12, 100, 100, 5, 5, 100, 100, 1, 'Male', "
 78 |                         . time() . ", '{$_POST['email']}', -1, '$ip')", $c);
 79 |         $i = mysql_insert_id($c);
 80 |         mysql_query("INSERT INTO userstats VALUES($i, 10, 10, 10, 10, 10)", $c);
 81 | 
 82 |         if ($_POST['ref'])
 83 |         {
 84 |             mysql_query(
 85 |                     "UPDATE `users`
 86 |                     SET `crystals` = `crystals` + 2
 87 |                     WHERE `userid` = {$_POST['ref']}");
 88 |             event_add($_POST['ref'],
 89 |                     "For refering $username to the game, you have earnt 2 valuable crystals!",
 90 |                     $c);
 91 |             $e_rip = mysql_real_escape_string($rem_IP, $c);
 92 |             $e_oip = mysql_real_escape_string($ip, $c);
 93 |             mysql_query(
 94 |                     "INSERT INTO `referals`
 95 |                     VALUES(NULL, {$_POST['ref']}, $i, " . time()
 96 |                             . ", '{$e_rip}', '$e_oip')", $c);
 97 |         }
 98 |         print 
 99 |                 "You have signed up, enjoy the game.<br />
100 | &gt; <a href='login.php'>Login</a>";
101 |     }
102 | }
103 | else
104 | {
105 |     $gref = abs((int) $_GET['REF']);
106 |     $fref = $gref ? $gref : '';
107 |     echo <<<EOF
108 |     <h3>
109 |       breakthenet Registration
110 |     </h3>
111 |     <form action="register.php" method="post">
112 |       Username: <input type="text" name="username" /><br />
113 |       Password: <input type="password" name="password" /><br />
114 |       Confirm Password: <input type="password" name="cpassword" /><br />
115 |       Email: <input type="text" name="email" /><br />
116 |       Promo Code: <input type="text" name="promo" /><br />
117 |       <input type="hidden" name="ref" value='{$fref}' />
118 |       <input type="submit" value="Submit" />
119 |     </form><br />
120 |     &gt; <a href='login.php'>Go Back</a>
121 | EOF;
122 | }
123 | print "</body></html>";
124 | 


--------------------------------------------------------------------------------
/cyberbank.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | print "<h3>Cyber Bank</h3>";
 28 | if ($ir['cybermoney'] > -1)
 29 | {
 30 |     switch ($_GET['action'])
 31 |     {
 32 |     case "deposit":
 33 |         deposit();
 34 |         break;
 35 | 
 36 |     case "withdraw":
 37 |         withdraw();
 38 |         break;
 39 | 
 40 |     default:
 41 |         index();
 42 |         break;
 43 |     }
 44 | 
 45 | }
 46 | else
 47 | {
 48 |     if (isset($_GET['buy']))
 49 |     {
 50 |         if ($ir['money'] > 9999999)
 51 |         {
 52 |             print
 53 |                     "Congratulations, you bought a bank account for \$10,000,000!<br />
 54 | <a href='cyberbank.php'>Start using my account</a>";
 55 |             mysql_query(
 56 |                     "UPDATE users SET money=money-10000000,cybermoney=0 WHERE userid=$userid",
 57 |                     $c);
 58 |         }
 59 |         else
 60 |         {
 61 |             print
 62 |                     "You do not have enough money to open an account.
 63 | <a href='explore.php'>Back to town...</a>";
 64 |         }
 65 |     }
 66 |     else
 67 |     {
 68 |         print
 69 |                 "Open a bank account today, just \$10,000,000!<br />
 70 | <a href='cyberbank.php?buy'>&gt; Yes, sign me up!</a>";
 71 |     }
 72 | }
 73 | 
 74 | function index()
 75 | {
 76 |     global $ir, $c, $userid, $h;
 77 |     print
 78 |             "\n<b>You currently have \${$ir['cybermoney']} in the bank.</b><br />
 79 | At the end of each day, your bank balance will go up by 7%.<br />
 80 | <table width='75%' border='2'> <tr> <td width='50%'><b>Deposit Money</b><br />
 81 | It will cost you 15% of the money you deposit, rounded up. The maximum fee is \$1,500,000.<form action='cyberbank.php?action=deposit' method='post'>
 82 | Amount: <input type='text' name='deposit' value='{$ir['money']}' /><br />
 83 | <input type='submit' value='Deposit' /></form></td> <td>
 84 | <b>Withdraw Money</b><br />
 85 | It will cost you 7.5% of the money you withdraw, rounded up. The maximum fee is \$750,000.<form action='cyberbank.php?action=withdraw' method='post'>
 86 | Amount: <input type='text' name='withdraw' value='{$ir['cybermoney']}' /><br />
 87 | <input type='submit' value='Withdraw' /></form></td> </tr> </table>";
 88 | }
 89 | 
 90 | function deposit()
 91 | {
 92 |     global $ir, $c, $userid, $h;
 93 |     $_POST['deposit'] = abs((int) $_POST['deposit']);
 94 |     if ($_POST['deposit'] > $ir['money'])
 95 |     {
 96 |         print "You do not have enough money to deposit this amount.";
 97 |     }
 98 |     else
 99 |     {
100 |         $fee = ceil($_POST['deposit'] * 15 / 100);
101 |         if ($fee > 1500000)
102 |         {
103 |             $fee = 1500000;
104 |         }
105 |         $gain = $_POST['deposit'] - $fee;
106 |         $ir['cybermoney'] += $gain;
107 |         mysql_query(
108 |                 "UPDATE users SET cybermoney=cybermoney+$gain, money=money-{$_POST['deposit']} where userid=$userid",
109 |                 $c);
110 |         print
111 |                 "You hand over \${$_POST['deposit']} to be deposited, <br />
112 | after the fee is taken (\$$fee), \$$gain is added to your account. <br />
113 | <b>You now have \${$ir['cybermoney']} in the Cyber Bank.</b><br />
114 | <a href='cyberbank.php'>&gt; Back</a>";
115 |     }
116 | }
117 | 
118 | function withdraw()
119 | {
120 |     global $ir, $c, $userid, $h;
121 |     $_POST['withdraw'] = abs((int) $_POST['withdraw']);
122 |     if ($_POST['withdraw'] > $ir['cybermoney'])
123 |     {
124 |         print "You do not have enough banked money to withdraw this amount.";
125 |     }
126 |     else
127 |     {
128 |         $fee = ceil($_POST['withdraw'] * 75 / 1000);
129 |         if ($fee > 750000)
130 |         {
131 |             $fee = 750000;
132 |         }
133 |         $gain = $_POST['withdraw'] - $fee;
134 |         $ir['cybermoney'] -= $gain;
135 |         mysql_query(
136 |                 "UPDATE users SET cybermoney=cybermoney-$gain, money=money+$gain where userid=$userid",
137 |                 $c);
138 |         print
139 |                 "You ask to withdraw $gain, <br />
140 | the teller hands it over after she takes the bank fees. <br />
141 | <b>You now have \${$ir['cybermoney']} in the Cyber Bank.</b><br />
142 | <a href='cyberbank.php'>&gt; Back</a>";
143 |     }
144 | }
145 | $h->endpage();
146 | 


--------------------------------------------------------------------------------
/slotsmachine3.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $tresder = (int) (rand(100, 999));
 28 | $maxbet = $ir['level'] * 500;
 29 | $_GET['tresde'] = abs((int) $_GET['tresde']);
 30 | if (($_SESSION['tresde'] == $_GET['tresde']) || $_GET['tresde'] < 100)
 31 | {
 32 |     die(
 33 |             "Error, you cannot refresh or go back on the slots, please use a side link to go somewhere else.<br />
 34 | <a href='slotsmachine3.php?tresde=$tresder'>&gt; Back</a>");
 35 | }
 36 | $_SESSION['tresde'] = $_GET['tresde'];
 37 | $_GET['bet'] = abs((int) $_GET['bet']);
 38 | print "<h3>5 Line Slotmachine</h3>";
 39 | if ($_GET['bet'])
 40 | {
 41 |     if ($_GET['bet'] > $ir['money'])
 42 |     {
 43 |         die(
 44 |                 "You are trying to bet more than you have.<br />
 45 | <a href='slotsmachine3.php?tresde=$tresder'>&gt; Back</a>");
 46 |     }
 47 |     else if ($_GET['bet'] > $maxbet)
 48 |     {
 49 |         die(
 50 |                 "You have gone over the max bet.<br />
 51 | <a href='slotsmachine3.php?tresde=$tresder'>&gt; Back</a>");
 52 |     }
 53 | 
 54 |     $slot[1] = (int) rand(0, 9);
 55 |     $slot[2] = (int) rand(0, 9);
 56 |     $slot[3] = (int) rand(0, 9);
 57 |     $slot[4] = (int) rand(0, 9);
 58 |     $slot[5] = (int) rand(0, 9);
 59 |     print
 60 |             "You place \${$_GET['bet']} into the slot and pull the pole.<br />
 61 | You see the numbers: <b>$slot[1] $slot[2] $slot[3] $slot[4] $slot[5]</b><br />
 62 | You bet \${$_GET['bet']} ";
 63 |     if ($slot[1] == $slot[2] && $slot[2] == $slot[3] && $slot[3] == $slot[4]
 64 |             && $slot[4] == $slot[5])
 65 |     {
 66 |         $won = $_GET['bet'] * 126;
 67 |         $gain = $_GET['bet'] * 125;
 68 |         print
 69 |                 "and won \$$won by lining up 5 numbers pocketing you \$$gain extra.";
 70 |     }
 71 |     else if (($slot[1] == $slot[2] && $slot[2] == $slot[3]
 72 |             && $slot[3] == $slot[4])
 73 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[4]
 74 |                     && $slot[4] == $slot[5])
 75 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[4]
 76 |                     && $slot[4] == $slot[5])
 77 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[4]
 78 |                     && $slot[4] == $slot[5])
 79 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[3]
 80 |                     && $slot[3] == $slot[5]))
 81 |     {
 82 |         $won = $_GET['bet'] * 36;
 83 |         $gain = $_GET['bet'] * 35;
 84 |         print
 85 |                 "and won \$$won by lining up 4 numbers pocketing you \$$gain extra.";
 86 |     }
 87 |     else if (($slot[1] == $slot[2] && $slot[2] == $slot[3])
 88 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[5])
 89 |             || ($slot[3] == $slot[4] && $slot[4] == $slot[5])
 90 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[5])
 91 |             || ($slot[1] == $slot[4] && $slot[4] == $slot[5])
 92 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[4])
 93 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[5])
 94 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[4])
 95 |             || ($slot[2] == $slot[4] && $slot[4] == $slot[5])
 96 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[5])
 97 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[4]))
 98 |     {
 99 |         $won = $_GET['bet'] * 9;
100 |         $gain = $_GET['bet'] * 8;
101 |         print
102 |                 "and won \$$won by lining up 3 numbers pocketing you \$$gain extra.";
103 |     }
104 |     else
105 |     {
106 |         $won = 0;
107 |         $gain = -$_GET['bet'];
108 |         print "and lost it.";
109 |     }
110 |     mysql_query(
111 |             "UPDATE users SET money=money+({$gain}) where userid=$userid", $c);
112 |     $tresder = (int) (rand(100, 999));
113 |     print
114 |             "<br />
115 | <a href='slotsmachine3.php?bet={$_GET['bet']}&tresde=$tresder'>&gt; Another time, same bet.</a><br />
116 | <a href='slotsmachine3.php?tresde=$tresder'>&gt; I'll continue, but I'm changing my bet.</a><br />
117 | <a href='explore.php'>&gt; Enough's enough, I'm off.</a>";
118 | }
119 | else
120 | {
121 |     print
122 |             "Ready to try your luck? Play today!<br />
123 | The maximum bet for your level is \$$maxbet.<br />
124 | <form action='slotsmachine3.php' method='get'>
125 | Bet: \$<input type='text' name='bet' value='5' /><br />
126 | <input type='hidden' name='tresde' value='$tresder' />
127 | <input type='submit' value='Play!!' />
128 | </form>";
129 | }
130 | 
131 | $h->endpage();
132 | 


--------------------------------------------------------------------------------
/stafflist.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | $staff = array();
 28 | $q =
 29 |         mysql_query(
 30 |                 "SELECT `userid`, `laston`, `username`, `level`, `money`,
 31 |  				 `user_level`
 32 |  				 FROM `users`
 33 |  				 WHERE `user_level` IN(2, 3, 4, 5)
 34 |  				 ORDER BY `userid` ASC",$c);
 35 | while ($r = mysql_fetch_assoc($q))
 36 | {
 37 |     $staff[$r['userid']] = $r;
 38 | }
 39 | mysql_free_result($q);
 40 | echo '
 41 | <b>Admins</b>
 42 | <br />
 43 | <table width="75%" cellspacing="1" cellpadding="1" border="1">
 44 | 		<tr style="background: gray;">
 45 | 			<th>User</th>
 46 | 			<th>Level</th>
 47 | 			<th>Money</th>
 48 | 			<th>Last Seen</th>
 49 | 			<th>Status</th>
 50 | 		</tr>
 51 |    ';
 52 | 
 53 | foreach ($staff as $r)
 54 | {
 55 |     if ($r['user_level'] == 2)
 56 |     {
 57 |         $on =
 58 |                 ($r['laston'] >= ($_SERVER['REQUEST_TIME'] - 900))
 59 |                         ? '<span style="color: green;">Online</span>'
 60 |                         : '<span style="color: green;">Offline</span>';
 61 |         echo '
 62 | 		<tr>
 63 | 			<td><a href="viewuser.php?u=' . $r['userid'] . '">'
 64 |                 . $r['username'] . '</a> [' . $r['userid'] . ']</td>
 65 | 			<td>' . $r['level'] . '</td>
 66 | 			<td>' . money_formatter($r['money'], '$') . '</td>
 67 | 			<td>' . date("F j, Y, g:i:s a", $r['laston']) . '</td>
 68 | 			<td>' . $on . '</td>
 69 | 		</tr>
 70 |    		';
 71 |     }
 72 | }
 73 | echo '</table>
 74 | 
 75 | <b>Secretaries</b>
 76 | <br />
 77 | <table width="75%" cellspacing="1" cellpadding="1" border="1">
 78 | 		<tr style="background: gray;">
 79 | 			<th>User</th>
 80 | 			<th>Level</th>
 81 | 			<th>Money</th>
 82 | 			<th>Last Seen</th>
 83 | 			<th>Status</th>
 84 | 		</tr>
 85 |    ';
 86 | foreach ($staff as $r)
 87 | {
 88 |     if ($r['user_level'] == 3)
 89 |     {
 90 |         $on =
 91 |                 ($r['laston'] >= ($_SERVER['REQUEST_TIME'] - 900))
 92 |                         ? '<span style="color: green;">Online</span>'
 93 |                         : '<span style="color: green;">Offline</span>';
 94 |         echo '
 95 | 		<tr>
 96 | 			<td><a href="viewuser.php?u=' . $r['userid'] . '">'
 97 |                 . $r['username'] . '</a> [' . $r['userid'] . ']</td>
 98 | 			<td>' . $r['level'] . '</td>
 99 | 			<td>' . money_formatter($r['money'], '$') . '</td>
100 | 			<td>' . date("F j, Y, g:i:s a", $r['laston']) . '</td>
101 | 			<td>' . $on . '</td>
102 | 		</tr>
103 |    		';
104 |     }
105 | }
106 | echo '</table>
107 | 
108 | <b>Assistants</b>
109 | <br />
110 | <table width="75%" cellspacing="1" cellpadding="1" border="1">
111 | 		<tr style="background: gray;">
112 | 			<th>User</th>
113 | 			<th>Level</th>
114 | 			<th>Money</th>
115 | 			<th>Last Seen</th>
116 | 			<th>Status</th>
117 | 		</tr>
118 |    ';
119 | foreach ($staff as $r)
120 | {
121 |     if ($r['user_level'] == 5)
122 |     {
123 |         $on =
124 |                 ($r['laston'] >= ($_SERVER['REQUEST_TIME'] - 900))
125 |                         ? '<span style="color: green;">Online</span>'
126 |                         : '<span style="color: green;">Offline</span>';
127 |         echo '
128 | 		<tr>
129 | 			<td><a href="viewuser.php?u=' . $r['userid'] . '">'
130 |                 . $r['username'] . '</a> [' . $r['userid'] . ']</td>
131 | 			<td>' . $r['level'] . '</td>
132 | 			<td>' . money_formatter($r['money'], '$') . '</td>
133 | 			<td>' . date("F j, Y, g:i:s a", $r['laston']) . '</td>
134 | 			<td>' . $on . '</td>
135 | 		</tr>
136 |    		';
137 |     }
138 | }
139 | echo '</table>
140 | 
141 | <b>IRC Ops</b>
142 | <br />
143 | <table width="75%" cellspacing="1" cellpadding="1" border="1">
144 | 		<tr style="background: gray;">
145 | 			<th>User</th>
146 | 			<th>Level</th>
147 | 			<th>Money</th>
148 | 			<th>Last Seen</th>
149 | 			<th>Status</th>
150 | 		</tr>
151 |    ';
152 | foreach ($staff as $r)
153 | {
154 |     if ($r['user_level'] == 4)
155 |     {
156 |         $on =
157 |                 ($r['laston'] >= ($_SERVER['REQUEST_TIME'] - 900))
158 |                         ? '<span style="color: green;">Online</span>'
159 |                         : '<span style="color: green;">Offline</span>';
160 |         echo '
161 | 		<tr>
162 | 			<td><a href="viewuser.php?u=' . $r['userid'] . '">'
163 |                 . $r['username'] . '</a> [' . $r['userid'] . ']</td>
164 | 			<td>' . $r['level'] . '</td>
165 | 			<td>' . money_formatter($r['money'], '$') . '</td>
166 | 			<td>' . date("F j, Y, g:i:s a", $r['laston']) . '</td>
167 | 			<td>' . $on . '</td>
168 | 		</tr>
169 |    		';
170 |     }
171 | }
172 | echo '</table>';
173 | $h->endpage();
174 | 


--------------------------------------------------------------------------------
/slotsmachine2.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | die("xD");
 28 | $tresder = (int) (rand(100, 999));
 29 | $maxbet = $ir['level'] * 50;
 30 | $_GET['tresde'] = abs((int) $_GET['tresde']);
 31 | if (($_SESSION['tresde'] == $_GET['tresde']) || $_GET['tresde'] < 100)
 32 | {
 33 |     die(
 34 |             "Error, you cannot refresh or go back on the slots, please use a side link to go somewhere else.<br />
 35 | <a href='slotsmachine2.php?tresde=$tresder'>&gt; Back</a>");
 36 | }
 37 | $_SESSION['tresde'] = $_GET['tresde'];
 38 | $_GET['bet'] = abs((int) $_GET['bet']);
 39 | print "<h3>Slots</h3>";
 40 | if ($_GET['bet'])
 41 | {
 42 |     if ($_GET['bet'] > $ir['money'])
 43 |     {
 44 |         die(
 45 |                 "You are trying to bet more than you have.<br />
 46 | <a href='slotsmachine2.php?tresde=$tresder'>&gt; Back</a>");
 47 |     }
 48 |     else if ($_GET['bet'] > $maxbet)
 49 |     {
 50 |         die(
 51 |                 "You have gone over the max bet.<br />
 52 | <a href='slotsmachine2.php?tresde=$tresder'>&gt; Back</a>");
 53 |     }
 54 | 
 55 |     for ($i = 1; $i <= 5; $i++)
 56 |     {
 57 |         $slot[$i] = strtoupper(base_convert(rand(0, 25) + 10, 10, 36));
 58 |     }
 59 |     print
 60 |             "You place \${$_GET['bet']} into the slot and pull the pole.<br />
 61 | You see the numbers: <b>$slot[1] $slot[2] $slot[3] $slot[4] $slot[5]</b><br />
 62 | You bet \${$_GET['bet']} ";
 63 |     if ($slot[1] == $slot[2] && $slot[2] == $slot[3] && $slot[3] == $slot[4]
 64 |             && $slot[4] == $slot[5])
 65 |     {
 66 |         $won = $_GET['bet'] * 76;
 67 |         $gain = $_GET['bet'] * 75;
 68 |         print
 69 |                 "and won \$$won by lining up 5 numbers pocketing you \$$gain extra.";
 70 |     }
 71 |     else if (($slot[1] == $slot[2] && $slot[2] == $slot[3]
 72 |             && $slot[3] == $slot[4])
 73 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[4]
 74 |                     && $slot[4] == $slot[5])
 75 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[4]
 76 |                     && $slot[4] == $slot[5])
 77 |             || ($slot[1] == $slot[2] && $slot[2]
 78 |  == $slot[4] && $slot[4] == $slot[5])
 79 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[3]
 80 |                     && $slot[3] == $slot[5]))
 81 |     {
 82 |         $won = $_GET['bet'] * 26;
 83 |         $gain = $_GET['bet'] * 25;
 84 |         print
 85 |                 "and won \$$won by lining up 4 numbers pocketing you \$$gain extra.";
 86 |     }
 87 |     else if (($slot[1] == $slot[2] && $slot[2] == $slot[3])
 88 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[5])
 89 |             || ($slot[3] == $slot[4] && $slot[4] == $slot[5])
 90 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[5])
 91 |             || ($slot[1] == $slot[4] && $slot[4] == $slot[5])
 92 |             || ($slot[1]
 93 |  == $slot[2] && $slot[2] == $slot[4])
 94 |             || ($slot[2] == $slot[3] && $slot[3] == $slot[5])
 95 |             || ($slot[1] == $slot[3] && $slot[3] == $slot[4])
 96 |  || ($slot[2] == $slot[3] && $slot[3] == $slot[4])
 97 |             || ($slot[2] == $slot[4] && $slot[4] == $slot[5])
 98 |             || ($slot[1] == $slot[2] && $slot[2] == $slot[5]))
 99 |     {
100 |         $won = $_GET['bet'] * 6;
101 |         $gain = $_GET['bet'] * 5;
102 |         print
103 |                 "and won \$$won by lining up 3 numbers pocketing you \$$gain extra.";
104 |     }
105 |     else if ($slot[1] == $slot[2] || $slot[1] == $slot[3]
106 |             || $slot[1] == $slot[4] || $slot[1] == $slot[5]
107 |             || $slot[2] == $slot[3] || $slot[2] == $slot[4]
108 |             || $slot[2] == $slot[5] || $slot[3] == $slot[4]
109 |             || $slot[3] == $slot[5] || $slot[4] == $slot[5])
110 |     {
111 |         $won = $_GET['bet'] * 3;
112 |         $gain = $_GET['bet'] * 2;
113 |         print
114 |                 "and won \$$won by lining up 2 numbers pocketing you \$$gain extra.";
115 |     }
116 |     else
117 |     {
118 |         $won = 0;
119 |         $gain = -$_GET['bet'];
120 |         print "and lost it.";
121 |     }
122 |     mysql_query(
123 |             "UPDATE users SET money=money+({$gain}) where userid=$userid", $c);
124 |     $tresder = (int) (rand(100, 999));
125 |     print
126 |             "<br />
127 | <a href='slotsmachine2.php?bet={$_GET['bet']}&tresde=$tresder'>&gt; Another time, same bet.</a><br />
128 | <a href='slotsmachine2.php?tresde=$tresder'>&gt; I'll continue, but I'm changing my bet.</a><br />
129 | <a href='explore.php'>&gt; Enough's enough, I'm off.</a>";
130 | }
131 | else
132 | {
133 |     print
134 |             "Ready to try your luck? Play today!<br />
135 | The maximum bet for your level is \$$maxbet.<br />
136 | <form action='slotsmachine2.php' method='get'>
137 | Bet: \$<input type='text' name='bet' value='5' /><br />
138 | <input type='hidden' name='tresde' value='$tresder' />
139 | <input type='submit' value='Play!!' />
140 | </form>";
141 | }
142 | 
143 | $h->endpage();
144 | 


--------------------------------------------------------------------------------
/header.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | if (strpos($_SERVER['PHP_SELF'], "header.php") !== false)
  4 | {
  5 |     exit;
  6 | }
  7 | 
  8 | class headers
  9 | {
 10 | 
 11 |     function startheaders()
 12 |     {
 13 |         global $ir;
 14 |         echo <<<EOF
 15 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 16 | <html xmlns="http://www.w3.org/1999/xhtml">
 17 | <head>
 18 | <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
 19 | <link href="css/game.css" type="text/css" rel="stylesheet" />
 20 | <title>breakthenet</title>
 21 | </head>
 22 | <body style='background-color: #C3C3C3;'>
 23 | 
 24 | EOF;
 25 |     }
 26 | 
 27 |     function userdata($ir, $lv, $fm, $cm, $dosessh = 1)
 28 |     {
 29 |         global $c, $userid;
 30 |         $ip = ($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
 31 |         mysql_query(
 32 |                 "UPDATE users SET laston=" . time()
 33 |                         . ",lastip='$ip' WHERE userid=$userid", $c);
 34 |         if (!$ir['email'])
 35 |         {
 36 |             die(
 37 |                     "<body>Your account may be broken. Please mail help@yourgamename.com stating your username and player ID.");
 38 |         }
 39 |         if ($dosessh && isset($_SESSION['attacking']))
 40 |         {
 41 |             if ($_SESSION['attacking'] > 0)
 42 |             {
 43 |                 print "You lost all your EXP for running from the fight.";
 44 |                 mysql_query("UPDATE users SET exp=0 WHERE userid=$userid", $c);
 45 |                 $_SESSION['attacking'] = 0;
 46 |             }
 47 |         }
 48 |         $enperc = (int) ($ir['energy'] / $ir['maxenergy'] * 100);
 49 |         $wiperc = (int) ($ir['will'] / $ir['maxwill'] * 100);
 50 |         $experc = (int) ($ir['exp'] / $ir['exp_needed'] * 100);
 51 |         $brperc = (int) ($ir['brave'] / $ir['maxbrave'] * 100);
 52 |         $hpperc = (int) ($ir['hp'] / $ir['maxhp'] * 100);
 53 |         $enopp = 100 - $enperc;
 54 |         $wiopp = 100 - $wiperc;
 55 |         $exopp = 100 - $experc;
 56 |         $bropp = 100 - $brperc;
 57 |         $hpopp = 100 - $hpperc;
 58 |         $d = "";
 59 |         $u = $ir['username'];
 60 |         if ($ir['donatordays'])
 61 |         {
 62 |             $u = "<font color=red>{$ir['username']}</font>";
 63 |             $d =
 64 |                     "<img src='donator.gif' alt='Donator: {$ir['donatordays']} Days Left' title='Donator: {$ir['donatordays']} Days Left' />";
 65 |         }
 66 |         print
 67 |                 "
 68 | <table width=100%><tr><td><img src='logo.png'></td>
 69 | <td><b>Name:</b> {$u} [{$ir['userid']}] $d<br />
 70 | <b>Money:</b> {$fm}<br />
 71 | <b>Level:</b> {$ir['level']}<br />
 72 | <b>Crystals:</b> {$ir['crystals']}<br />
 73 | [<a href='logout.php'>Emergency Logout</a>]</td><td>
 74 | <b>Energy:</b> {$enperc}%<br />
 75 | <img src=bargreen.gif width=$enperc height=10><img src=barred.gif width=$enopp height=10><br />
 76 | <b>Will:</b> {$wiperc}%<br />
 77 | <img src=bargreen.gif width=$wiperc height=10><img src=barred.gif width=$wiopp height=10><br />
 78 | <b>Brave:</b> {$ir['brave']}/{$ir['maxbrave']}<br />
 79 | <img src=bargreen.gif width=$brperc height=10><img src=barred.gif width=$bropp height=10><br />
 80 | <b>EXP:</b> {$experc}%<br />
 81 | <img src=bargreen.gif width=$experc height=10><img src=barred.gif width=$exopp height=10><br />
 82 | <b>Health:</b> {$hpperc}%<br />
 83 | <img src=bargreen.gif width=$hpperc height=10><img src=barred.gif width=$hpopp height=10></td></tr></table></div><center><b><u><a href='voting.php'>Vote for breakthenet on various gaming sites and be rewarded!</a></u></b></center><br />
 84 | <center><b><u><a href='donator.php'>Donate to breakthenet, it's only \$3 and gets you a lot of benefits!</a></u></b></center><br />
 85 |                 ";
 86 |         $q = mysql_query("SELECT * FROM ads ORDER BY rand() LIMIT 1", $c);
 87 |         if (mysql_num_rows($q))
 88 |         {
 89 |             $r = mysql_fetch_array($q);
 90 |             print
 91 |                     "<center><a href='ad.php?ad={$r['adID']}'><img src='{$r['adIMG']}' alt='Paid Advertisement' /></a></center><br />";
 92 |             mysql_query(
 93 |                     "UPDATE ads SET adVIEWS=adVIEWS+1 WHERE adID={$r['adID']}",
 94 |                     $c);
 95 |         }
 96 |         print "<table width=100%><tr><td width=20% valign='top'>
 97 | ";
 98 |         if ($ir['fedjail'])
 99 |         {
100 |             $q =
101 |                     mysql_query(
102 |                             "SELECT * FROM fedjail WHERE fed_userid=$userid",
103 |                             $c);
104 |             $r = mysql_fetch_array($q);
105 |             die(
106 |                     "<b><font color=red size=+1>You have been put in the breakthenet Federal Jail for {$r['fed_days']} day(s).<br />
107 | Reason: {$r['fed_reason']}</font></b></body></html>");
108 |         }
109 |         if (file_exists('ipbans/' . $ip))
110 |         {
111 |             die(
112 |                     "<b><font color=red size=+1>Your IP has been banned, there is no way around this.</font></b></body></html>");
113 |         }
114 |     }
115 | 
116 |     function menuarea()
117 |     {
118 |         include "mainmenu.php";
119 |         global $ir, $c;
120 |         print "</td><td valign='top'>
121 | ";
122 |     }
123 | 
124 |     function endpage()
125 |     {
126 |         $year = date('Y');
127 |         print
128 |                 "</td></tr></table>
129 |         <div style='font-style: italic; text-align: center'>
130 |       		Powered by codes made by Dabomstew. Copyright &copy; {$year} admin.
131 |     	</div>
132 |         </body>
133 | 		</html>";
134 |     }
135 | }
136 | 


--------------------------------------------------------------------------------
/preferences_c5.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | 
 28 | switch ($_GET['action'])
 29 | {
 30 | case 'sexchange2':
 31 |     do_sex_change();
 32 |     break;
 33 | 
 34 | case 'sexchange':
 35 |     conf_sex_change();
 36 |     break;
 37 | 
 38 | case 'passchange2':
 39 |     do_pass_change();
 40 |     break;
 41 | 
 42 | case 'passchange':
 43 |     pass_change();
 44 |     break;
 45 | 
 46 | case 'namechange2':
 47 |     do_name_change();
 48 |     break;
 49 | 
 50 | case 'namechange':
 51 |     name_change();
 52 |     break;
 53 | 
 54 | case 'picchange2':
 55 |     do_pic_change();
 56 |     break;
 57 | 
 58 | case 'picchange':
 59 |     pic_change();
 60 |     break;
 61 | 
 62 | default:
 63 |     pic_change();
 64 |     break;
 65 | }
 66 | 
 67 | function prefs_home()
 68 | {
 69 |     global $ir, $c, $userid, $h;
 70 |     print 
 71 |             "<h3>Preferences</h3>
 72 | <a href='preferences.php?action=sexchange'>Sex Change</a><br />
 73 | <a href='preferences.php?action=passchange'>Password Change</a><br />
 74 | <a href='preferences.php?action=namechange'>Name Change</a><br />
 75 | <a href='preferences.php?action=picchange'>Display Pic Change</a>";
 76 | }
 77 | 
 78 | function conf_sex_change()
 79 | {
 80 |     global $ir, $c, $userid, $h;
 81 |     if ($ir['gender'] == "Male")
 82 |     {
 83 |         $g = "Female";
 84 |     }
 85 |     else
 86 |     {
 87 |         $g = "Male";
 88 |     }
 89 |     print 
 90 |             "Having the trans-gender costs 20 Crystals.<br />Are you sure you want to become a $g?<br />
 91 | <a href='preferences.php?action=sexchange2'>Yes</a> | <a href='preferences.php'>No</a>";
 92 | }
 93 | 
 94 | function do_sex_change()
 95 | {
 96 |     global $ir, $c, $userid, $h;
 97 |     if ($ir['crystals'] < 20)
 98 |     {
 99 |         print "You don't have enough crystals!";
100 |         exit;
101 |     }
102 |     else if ($ir['gender'] == "Male")
103 |     {
104 |         $g = "Female";
105 |     }
106 |     else
107 |     {
108 |         $g = "Male";
109 |     }
110 |     mysql_query("UPDATE users SET gender='$g' WHERE userid=$userid", $c);
111 |     mysql_query("UPDATE users SET crystals=crystals-20 WHERE userid=$userid",
112 |             $c);
113 |     mysql_query("UPDATE users SET crystals=0 WHERE crystals<0", $c);
114 |     print "Success, you are now $g!<br />
115 | <a href='preferences.php'>Back</a>";
116 | }
117 | 
118 | function pass_change()
119 | {
120 |     global $ir, $c, $userid, $h;
121 |     print 
122 |             "<h3>Password Change</h3><form action='preferences.php?action=passchange2' method='post'>Current Password: <input type='password' name='oldpw' /><br />
123 | New Password: <input type='password' name='newpw' /><br />
124 | Confirm: <input type='password' name='newpw2' /><br />
125 | <input type='submit' value='Change PW' /></form>";
126 | }
127 | 
128 | function do_pass_change()
129 | {
130 |     global $ir, $c, $userid, $h;
131 |     $oldpw = stripslashes($_POST['oldpw']);
132 |     $newpw = stripslashes($_POST['newpw']);
133 |     $newpw2 = stripslashes($_POST['newpw2']);
134 |     if (!verify_user_password($oldpw, $ir['userpass']))
135 |     {
136 |         echo "
137 | 		The current password you entered was wrong.<br />
138 | 		<a href='preferences.php?action=passchange'>&gt; Back</a>
139 |    		";
140 |     }
141 |     else if ($newpw !== $newpw2)
142 |     {
143 |         echo "The new passwords you entered did not match!<br />
144 | 		<a href='preferences.php?action=passchange'>&gt; Back</a>";
145 |     }
146 |     else
147 |     {
148 |         // Re-encode password
149 |         $new_psw =
150 |                 mysql_real_escape_string(
151 |                         encode_password($newpw), $c);
152 |         mysql_query(
153 |                 "UPDATE `users`
154 |                  SET `userpass` = '{$new_psw}'
155 |                  WHERE `userid` = {$ir['userid']}", $c);
156 |         echo "Password changed!<br />
157 |         &gt; <a href='preferences.php'>Go Back</a>";
158 |     }
159 | }
160 | 
161 | function name_change()
162 | {
163 |     global $ir, $c, $userid, $h;
164 |     print 
165 |             "<h3>Name Change</h3>
166 | Changing your name now costs \$3000<br />
167 | Please note that you still use the same name to login, this procedure simply changes the name that is displayed. <form action='preferences.php?action=namechange2' method='post'>
168 | New Name: <input type='text' name='newname' /><br />
169 | <input type='submit' value='Change Name' /></form>";
170 | }
171 | 
172 | function do_name_change()
173 | {
174 |     global $ir, $c, $userid, $h;
175 |     if ($ir['money'] < 3000)
176 |     {
177 |         print "You don't have enough money!";
178 |         exit;
179 |     }
180 |     else if ($_POST['newname'] == "")
181 |     {
182 |         print 
183 |                 "You did not enter a new name.<br />
184 | <a href='preferences.php?action=namechange'>&gt; Back</a>";
185 |     }
186 |     else
187 |     {
188 |         $_POST['newname'] =
189 |                 mysql_real_escape_string(
190 |                         htmlentities(stripslashes($_POST['newname']),
191 |                                 ENT_QUOTES, 'ISO-8859-1'), $c);
192 |         mysql_query(
193 |                 "UPDATE users SET username='{$_POST['newname']}' WHERE userid=$userid",
194 |                 $c);
195 |         mysql_query("UPDATE users SET money=money-3000 WHERE userid=$userid",
196 |                 $c);
197 |         mysql_query("UPDATE users SET money=0 WHERE money<0", $c);
198 |         print "Username changed!";
199 |     }
200 | }
201 | 
202 | function pic_change()
203 | {
204 |     global $ir, $c, $userid, $h;
205 |     print "<iframe width='100%' height='100%' src='page_loader.php?page=preferences_c5_changepic.php'></iframe>";
206 | }
207 | 
208 | function do_pic_change()
209 | {
210 | }
211 | 
212 | $h->endpage();
213 | 


--------------------------------------------------------------------------------
/cmarket.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | session_start();
  4 | require "global_func.php";
  5 | if ($_SESSION['loggedin'] == 0)
  6 | {
  7 |     header("Location: login.php");
  8 |     exit;
  9 | }
 10 | $userid = $_SESSION['userid'];
 11 | require "header.php";
 12 | $h = new headers;
 13 | $h->startheaders();
 14 | include "mysql.php";
 15 | global $c;
 16 | $is =
 17 |         mysql_query(
 18 |                 "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
 19 |                 $c) or die(mysql_error());
 20 | $ir = mysql_fetch_array($is);
 21 | check_level();
 22 | $fm = money_formatter($ir['money']);
 23 | $cm = money_formatter($ir['crystals'], '');
 24 | $lv = date('F j, Y, g:i a', $ir['laston']);
 25 | $h->userdata($ir, $lv, $fm, $cm);
 26 | $h->menuarea();
 27 | print "<h3>Crystal Market</h3>";
 28 | switch ($_GET['action'])
 29 | {
 30 | case "buy":
 31 |     crystal_buy();
 32 |     break;
 33 | 
 34 | case "remove":
 35 |     crystal_remove();
 36 |     break;
 37 | 
 38 | case "add":
 39 |     crystal_add();
 40 |     break;
 41 | 
 42 | default:
 43 |     cmarket_index();
 44 |     break;
 45 | }
 46 | 
 47 | function cmarket_index()
 48 | {
 49 |     global $ir, $c, $userid, $h;
 50 |     print
 51 |             "<a href='cmarket.php?action=add'>&gt; Add A Listing</a><br /><br />
 52 | Viewing all listings...
 53 | <table width=75%> <tr style='background:gray'> <th>Adder</th> <th>Qty</th> <th>Price each</th> <th>Price total</th> <th>Links</th> </tr>";
 54 |     $q =
 55 |             mysql_query(
 56 |                     "SELECT cm.*, u.* FROM crystalmarket cm LEFT JOIN users u ON u.userid=cm.cmADDER ORDER BY cmPRICE/cmQTY ASC",
 57 |                     $c);
 58 |     while ($r = mysql_fetch_array($q))
 59 |     {
 60 |         if ($r['cmADDER'] == $userid)
 61 |         {
 62 |             $link =
 63 |                     "<a href='cmarket.php?action=remove&ID={$r['cmID']}'>Remove</a>";
 64 |         }
 65 |         else
 66 |         {
 67 |             $link =
 68 |                     "<a href='cmarket.php?action=buy&ID={$r['cmID']}'>Buy</a>";
 69 |         }
 70 |         $each = (int) $r['cmPRICE'] / $r['cmQTY'];
 71 |         print
 72 |                 "\n<tr> <td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> [{$r['userid']}]</td> <td>{$r['cmQTY']}</td> <td> \$"
 73 |                         . number_format($each) . "</td> <td>\$"
 74 |                         . number_format($r['cmPRICE'])
 75 |                         . "</td> <td>[$link]</td> </tr>";
 76 |     }
 77 |     print "</table>";
 78 | }
 79 | 
 80 | function crystal_remove()
 81 | {
 82 |     global $ir, $c, $userid, $h;
 83 |     $q =
 84 |             mysql_query(
 85 |                     "SELECT * FROM crystalmarket WHERE cmID={$_GET['ID']} AND cmADDER=$userid",
 86 |                     $c);
 87 |     if (!mysql_num_rows($q))
 88 |     {
 89 |         print
 90 |                 "Error, either these crystals do not exist, or you are not the owner.<br />
 91 | <a href='cmarket.php'>&gt; Back</a>";
 92 |         $h->endpage();
 93 |         exit;
 94 |     }
 95 |     $r = mysql_fetch_array($q);
 96 |     mysql_query(
 97 |             "UPDATE users SET crystals=crystals+{$r['cmQTY']} where userid=$userid",
 98 |             $c) or die(mysql_error());
 99 |     mysql_query("DELETE FROM crystalmarket WHERE cmID={$_GET['ID']}", $c);
100 |     print
101 |             "Crystals removed from market!<br />
102 | <a href='cmarket.php'>&gt; Back</a>";
103 | }
104 | 
105 | function crystal_buy()
106 | {
107 |     global $ir, $c, $userid, $h;
108 |     error_log("SELECT * FROM crystalmarket cm WHERE cmID={$_GET['ID']}");
109 |     $q = mysql_query("SELECT * FROM crystalmarket cm WHERE cmID={$_GET['ID']}", $c);
110 |     if (!mysql_num_rows($q))
111 |     {
112 |         print
113 |                 "Error, either these crystals do not exist, or they have already been bought.<br />
114 | <a href='cmarket.php'>&gt; Back</a>";
115 |         $h->endpage();
116 |         exit;
117 |     }
118 |     $r = mysql_fetch_array($q);
119 |     if ($r['cmPRICE'] > $ir['money'])
120 |     {
121 |         print
122 |                 "Error, you do not have the funds to buy these crystals.<br />
123 | <a href='cmarket.php'>&gt; Back</a>";
124 |         $h->endpage();
125 |         exit;
126 |     }
127 |     error_log("UPDATE users SET crystals=crystals+{$r['cmQTY']} where userid=$userid");
128 |     mysql_query("UPDATE users SET crystals=crystals+{$r['cmQTY']} where userid=$userid", $c);
129 |     mysql_query("DELETE FROM crystalmarket WHERE cmID={$_GET['ID']}", $c);
130 |     mysql_query(
131 |             "UPDATE users SET money=money-{$r['cmPRICE']} where userid=$userid",
132 |             $c);
133 |     mysql_query(
134 |             "UPDATE users SET money=money+{$r['cmPRICE']} where userid={$r['cmADDER']}",
135 |             $c);
136 |     //event_add($r['cmADDER'], "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['cmQTY']} crystals from the market for \$". number_format($r['cmPRICE']) . ".", $c);
137 |     print
138 |             "You bought the {$r['cmQTY']} crystals from the market for \$"
139 |                     . number_format($r['cmPRICE']) . ".";
140 | 
141 | }
142 | 
143 | function crystal_add()
144 | {
145 |     global $ir, $c, $userid, $h;
146 |     $_POST['amnt'] = abs((int) $_POST['amnt']);
147 |     $_POST['price'] = abs((int) $_POST['price']);
148 |     if ($_POST['amnt'])
149 |     {
150 |         if ($_POST['amnt'] > $ir['crystals'])
151 |         {
152 |             die(
153 |                     "You are trying to add more crystals to the market than you have.");
154 |         }
155 |         $tp = $_POST['amnt'] * $_POST['price'];
156 |         mysql_query(
157 |                 "INSERT INTO crystalmarket VALUES(NULL,{$_POST['amnt']},$userid,$tp)",
158 |                 $c);
159 |         mysql_query(
160 |                 "UPDATE users SET crystals=crystals-{$_POST['amnt']} WHERE userid=$userid",
161 |                 $c);
162 |         print
163 |                 "Crystals added to market!<br />
164 | <a href='cmarket.php'>&gt; Back</a>";
165 |     }
166 |     else
167 |     {
168 |         print
169 |                 "<b>Adding a listing...</b><br /><br />
170 | You have <b>{$ir['crystals']}</b> crystal(s) that you can add to the market.<form action='cmarket.php?action=add' method='post'><table width=50% border=2><tr>
171 | <td>Crystals:</td> <td><input type='text' name='amnt' value='{$ir['crystals']}' /></td></tr><tr>
172 | <td>Price Each:</td> <td><input type='text' name='price' value='200' /></td></tr><tr>
173 | <td colspan=2 align=center><input type='submit' value='Add To Market' /></tr></table></form>";
174 |     }
175 | }
176 | $h->endpage();
177 | 


--------------------------------------------------------------------------------
/mainmenu.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | if (strpos($_SERVER['PHP_SELF'], "mainmenu.php") !== false)
  4 | {
  5 |     exit;
  6 | }
  7 | global $c, $ir;
  8 | if (!$ir['hospital'])
  9 | {
 10 |     print
 11 |             "<a href='index.php'>Home</a><br />
 12 | <a href='inventory.php'>Items</a><br />
 13 | <a href='explore.php'>Explore</a><br />
 14 | <a href='events.php'>";
 15 |     $d =
 16 |             mysql_query(
 17 |                     "SELECT COUNT(*) as cnt FROM events WHERE evUSER={$ir['userid']} AND evREAD=0",
 18 |                     $c) or die(mysql_error());
 19 |     $r = mysql_fetch_array($d);
 20 |     if ($r['cnt'] > 0)
 21 |     {
 22 |         print "<b>Events ({$r['cnt']})</b>";
 23 |     }
 24 |     else
 25 |     {
 26 |         print "Events (0)";
 27 |     }
 28 |     print "</a><br />
 29 | <a href='mailbox.php'>";
 30 |     $d2 =
 31 |             mysql_query(
 32 |                     "SELECT COUNT(*) as cnt FROM mail WHERE mail_to={$ir['userid']} AND mail_read=0",
 33 |                     $c) or die(mysql_error());
 34 |     $r = mysql_fetch_array($d2);
 35 |     if ($r['cnt'] > 0)
 36 |     {
 37 |         print "<b>Mail ({$r['cnt']})</b>";
 38 |     }
 39 |     else
 40 |     {
 41 |         print "Mail (0)";
 42 |     }
 43 |     print
 44 |             "</a><br />
 45 | <a href='gym.php'>Gym</a><br />
 46 | <a href='criminal.php'>Crimes</a><br />
 47 | <a href='education.php'>Local School</a><br />
 48 | <a href='monopaper.php'>Announcements</a><br />
 49 | <a href='search.php'>Search</a><br />
 50 | <a href='advsearch.php'>Advanced Search</a><br />";
 51 |     if ($ir['user_level'] > 1)
 52 |     {
 53 |         print "<hr />
 54 | <b>Staff Only</b><br />\n";
 55 |         if ($ir['user_level'] < 6 and $ir['user_level'] != 4)
 56 |         {
 57 |             print "<a href='new_staff.php'>Staff Panel</a><br />\n";
 58 |         }
 59 |     }
 60 |     if ($ir['user_level'] > 1)
 61 |     {
 62 |         print "<hr /><b>Staff Online:</b><br />";
 63 |         $q =
 64 |                 mysql_query(
 65 |                         "SELECT * FROM users WHERE laston > " . (time() - 900)
 66 |                                 . " AND user_level>1 ORDER BY userid ASC", $c);
 67 |         while ($r = mysql_fetch_array($q))
 68 |         {
 69 |             $la = time() - $r['laston'];
 70 |             $unit = "secs";
 71 |             if ($la >= 60)
 72 |             {
 73 |                 $la = (int) ($la / 60);
 74 |                 $unit = "mins";
 75 |             }
 76 |             if ($la >= 60)
 77 |             {
 78 |                 $la = (int) ($la / 60);
 79 |                 $unit = "hours";
 80 |                 if ($la >= 24)
 81 |                 {
 82 |                     $la = (int) ($la / 24);
 83 |                     $unit = "days";
 84 |                 }
 85 |             }
 86 |             print
 87 |                     "<a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> ($la $unit)<br />";
 88 |         }
 89 |     }
 90 |     if ($ir['donatordays'])
 91 |     {
 92 |         print
 93 |                 "<hr />
 94 | <b>Donators Only</b><br />
 95 | <a href='friendslist.php'>Friends List</a><br />
 96 | <a href='blacklist.php'>Black List</a>";
 97 |     }
 98 |     print
 99 |             "<hr />
100 | <a href='preferences.php'>Preferences</a><br />
101 | <b>
102 | <a href='preferences_c1.php'>Preferences: Challenge 1</a><br />
103 | <a href='preferences_c2.php'>Preferences: Challenge 2</a><br />
104 | <a href='preferences_c3.php'>Preferences: Challenge 3</a><br />
105 | <a href='preferences_c4.php'>Preferences: Challenge 4</a><br />
106 | <a href='preferences_c5.php'>Preferences: Challenge 5</a><br />
107 | </b>
108 | <a href='preport.php'>Player Report</a><br />
109 | <a href='helptutorial.php'>Help Tutorial</a><br />
110 | <a href='gamerules.php'>Game Rules</a><br />
111 | <a href='viewuser.php?u={$ir['userid']}'><b>My Profile</b></a><br />
112 | <a href='logout.php'>Logout</a><br /><br />
113 | Time is now<br />
114 |             ";
115 |     echo date('F j, Y') . "<br />" . date('g:i:s a');
116 | }
117 | else
118 | {
119 |     print
120 |             "<a href='index.php'>Home</a><br />
121 | <a href='inventory.php'>Items</a><br />
122 | <a href='events.php'>";
123 |     $d =
124 |             mysql_query(
125 |                     "SELECT COUNT(*) as cnt FROM events WHERE evUSER={$ir['userid']} AND evREAD=0",
126 |                     $c) or die(mysql_error());
127 |     $r = mysql_fetch_array($d);
128 |     if ($r['cnt'] > 0)
129 |     {
130 |         print "<b>Events ({$r['cnt']})</b>";
131 |     }
132 |     else
133 |     {
134 |         print "Events (0)";
135 |     }
136 |     print "</a><br />
137 | <a href='mailbox.php'>";
138 |     $d2 =
139 |             mysql_query(
140 |                     "SELECT COUNT(*) as cnt FROM mail WHERE mail_to={$ir['userid']} AND mail_read=0",
141 |                     $c) or die(mysql_error());
142 |     $r = mysql_fetch_array($d2);
143 |     if ($r['cnt'] > 0)
144 |     {
145 |         print "<b>Mail ({$r['cnt']})</b>";
146 |     }
147 |     else
148 |     {
149 |         print "Mail (0)";
150 |     }
151 |     print
152 |             "</a><br />
153 | <a href='monopaper.php'>Announcements</a><br />
154 | <a href='search.php'>Search</a><br />";
155 |     if ($ir['user_level'] > 1)
156 |     {
157 |         print "<hr />
158 | <b>Staff Only</b><br />";
159 |         if ($ir['user_level'] < 6 and $ir['user_level'] != 4)
160 |         {
161 |             print "<a href='new_staff.php'>Staff Panel</a><br />\n";
162 |         }
163 |     }
164 |     if ($ir['user_level'] > 1)
165 |     {
166 |         print "<hr /><b>Staff Online:</b><br />";
167 |         $q =
168 |                 mysql_query(
169 |                         "SELECT * FROM users WHERE laston>(" . time()
170 |                                 . "-15*60) AND user_level>1 ORDER BY userid ASC",
171 |                         $c);
172 |         while ($r = mysql_fetch_array($q))
173 |         {
174 |             $la = time() - $r['laston'];
175 |             $unit = "secs";
176 |             if ($la >= 60)
177 |             {
178 |                 $la = (int) ($la / 60);
179 |                 $unit = "mins";
180 |             }
181 |             if ($la >= 60)
182 |             {
183 |                 $la = (int) ($la / 60);
184 |                 $unit = "hours";
185 |                 if ($la >= 24)
186 |                 {
187 |                     $la = (int) ($la / 24);
188 |                     $unit = "days";
189 |                 }
190 |             }
191 |             print
192 |                     "<a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> ($la $unit)<br />";
193 |         }
194 |     }
195 |     if ($ir['donatordays'])
196 |     {
197 |         print
198 |                 "<hr />
199 | <b>Donators Only</b><br />
200 | <a href='friendslist.php'>Friends List</a><br />
201 | <a href='blacklist.php'>Black List</a>";
202 |     }
203 |     print
204 |             "<hr />
205 | <a href='preferences.php'>Preferences</a><br />
206 | <a href='preport.php'>Player Report</a><br />
207 | <a href='helptutorial.php'>Help Tutorial</a><br />
208 | <a href='gamerules.php'>Game Rules</a><br />
209 | <a href='viewuser.php?u={$ir['userid']}'>My Profile</a><br />
210 | <a href='logout.php'>Logout</a><br /><br />
211 | Time is now<br />
212 |             ";
213 |     echo date('F j, Y') . "<br />" . date('g:i:s a');
214 | }
215 | 


--------------------------------------------------------------------------------