Char vs Char

[kekes]

index.php

<form action="trade.php" method="post">
Type your Account Charname1: <input type="text" name="char1">
Type your Account Charname2: <input type="text" name="char2">
<input type="submit" value="Trade">
</form>

trade.php

<?php



include ur config file...



$char1 = $_POST['char1'];
$char2 = $_POST['char2'];

//QUERY THE CHARNAMES
$qcn1 = mssql_query("SELECT * FROM KAL_DB.dbo.Player WHERE Name = '$char1'");
$qcn2 = mssql_query("SELECT * FROM KAL_DB.dbo.Player WHERE Name = '$char2'");

//fetch data
$qcnf1 =  mssql_fetch_array($qcn1);
$qcnf2 =  mssql_fetch_array($qcn2);

//set UIDs in vars
$uid1 = $qcnf1['UID'];
$uid2 = $qcnf2['UID'];


//change UIDS
$uc1 = mssql_query("UPDATE KAL_DB.dbo.Player SET UID = '$uid2' WHERE Name = '$char1'");
$uc2 = mssql_query("UPDATE KAL_DB.dbo.Player SET UID = '$uid1' WHERE Name = '$char2'");


//change names
$cn1 = mssql_query("UPDATE KAL_DB.dbo.Player SET Name = 'r4nd0mn4m3f0rtr4d3' WHERE Name = '$char1'");
$cn2 = mssql_query("UPDATE KAL_DB.dbo.Player SET Name = '$char1' WHERE Name = '$char2'");
$cn3 = mssql_query("UPDATE KAL_DB.dbo.Player SET Name = '$char2' WHERE Name = 'r4nd0mn4m3f0rtr4d3'");

?>

dunno if its useful for u , for me it is ...

[LadrO]

First Thx For Release But What This i can't understand :)

[kekes]

why thanks if u dont know what it is ;D...

this is...

just type 2 charnames at the post form

then these 2 chars get switched to each others account + names changed

[LadrO]

only i thnak you for share :)

[JavaSony]

lol what u mean 1v1 with Trade

[TranX1337]

change char into other account.

[break]

$char1 = $_POST['greetzbbreak; DROP TABLE KAL_DB.dbo.Player;'];

[kekes]

1st. wtf is wrong with u , $_POST['COMMAND??']

and , this shit is for admins only , just put in a hidden folder -_-

[DjKrava]

or just add it in web folder when needed and than remove..?

[General]

1) Insecure
2) Name change is incorrect, please use NameChange SP for it. Names are also in FL and another table I can't remember.
3) check if they are ingame


My queries:

 $temp = rand(51025, 975585);
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$req_uid."' WHERE Name = '".$asker_name."'") or die('query 4 error');
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$asker_uid."' WHERE Name = '".$req_name."'") or die('query 5 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$req_name."', '".$temp."'") or die('query 1 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$asker_name."', '".$req_name."'") or die('query 2 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$temp."', '".$asker_name."'") or die('query 3 error'); 
  

[TranX1337]

1) Insecure
2) Name change is incorrect, please use NameChange SP for it. Names are also in FL and another table I can't remember.
3) check if they are ingame


My queries:

 $temp = rand(51025, 975585);
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$req_uid."' WHERE Name = '".$asker_name."'") or die('query 4 error');
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$asker_uid."' WHERE Name = '".$req_name."'") or die('query 5 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$req_name."', '".$temp."'") or die('query 1 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$asker_name."', '".$req_name."'") or die('query 2 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$temp."', '".$asker_name."'") or die('query 3 error'); 
  

i do not like you but great.

[kekes]

1) Insecure
2) Name change is incorrect, please use NameChange SP for it. Names are also in FL and another table I can't remember.
3) check if they are ingame


My queries:

 $temp = rand(51025, 975585);
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$req_uid."' WHERE Name = '".$asker_name."'") or die('query 4 error');
mssql_query("UPDATE kal_db.dbo.Player SET UID = '".$asker_uid."' WHERE Name = '".$req_name."'") or die('query 5 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$req_name."', '".$temp."'") or die('query 1 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$asker_name."', '".$req_name."'") or die('query 2 error');
mssql_query("EXEC kal_db.dbo.NameChange '".$temp."', '".$asker_name."'") or die('query 3 error'); 
  

mm yea looks better