i need this script with sql inject check anybody can do that for me?
Code:
<style type="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p>
<style type="text/css">
<!--
.style1 {color: #FF0000 **
.style2 {color: #FF0000 **
.Estilo5 {color: #666666**
.Estilo6 {font-size: larger**
.Estilo8 {color: #FF0000; font-weight: bold**
-->
</style><body leftmargin="0" topmargin="0">
<?php
require 'config.php';
$name = stripslashes($_POST['name']);
$login = stripslashes($_POST['login']);
$lvlreq = 349;
$newlvl = 1;
$exp = 0;
$money = 50000000
?>
<?php
$conn = mssql_connect("$dbhost","$dbuser","$dbpasswd");
mssql_select_db('MuOnline', $conn);
$query_reset = mssql_query("SELECT * FROM Character WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'");
while($row_reset = mssql_fetch_array($query_reset))
{
$resetcount = $row_reset['Resets'];
$resetplus = $resetcount + 1;
$value_points = 350 * $resetplus;
$stat_points = 26;
**
if (mssql_num_rows(mssql_query("SELECT * FROM Character WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'")) > 0) {
$row = mssql_fetch_array(mssql_query("SELECT * FROM Character WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'"));
if ($row['cLevel'] > '349') {
if ($row['Money'] > $money) {
$money_total = $row['Money'] - $money ;
$query = mssql_query("
UPDATE Character SET cLevel = '$newlvl' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET money = '$money_total' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Experience = '$exp' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET LevelUpPoint = '$value_points' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Strength = '$stat_points' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Dexterity = '$stat_points' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Vitality = '$stat_points' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Energy = '$stat_points' WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'
UPDATE Character SET Resets = Resets+1 WHERE Name = '".$_POST['name']."' AND AccountID = '".$_POST['login']."'");
if (!$query) {
echo "<font color='0099FF'><font size='2'>Character Reset could not be properly preformed. Database threw an error.";
** else {
echo "<font color='0099FF'><font size='2'>".$_POST['name']." is successfully Reseted..";
**
** else {
echo "<font color='0099FF'><font size='2'>Character Reset could not be preformed. Not enough zen.";
echo "<br>Actual (".$row['Money'].") - Needed ($money)";
**
** else {
echo "<font color='0099FF'><font size='2'>Character Reset could not be preformed. Your not Level 350.";
**
** else {
echo "<font color='0099FF'><font size='2'>Character Reset could not be performed. Character ".$_POST['name']." or the Login given do not match.";
**
?>
</p>
<div align="center">
<table width="67%" height="339" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<tr>
</td>
</tr>
</table>
</div>
</body>
</html>
</body>
</html>