Useful Links for things regarding this thread.
v14 Server Files (Coming Soon)
All In One Database
DYO Manager
FlyFF ResEditor
MicroSoft SQL Server 2005 Edition
Setting up database
Spoiler:
Note : v14 Database
1. You must have MicroSoft SQL Server 2005 Edition already downloaded, as well as the All In One Database SQL file.
2. Open MicroSoft SQL Server 2005.
3. Login with Windows Authentication.
4. Go to "File > Open > File".
5. Select the "All In One" SQL file.
6. Once you see the script in MicroSoft SQL Server 2005, click the button "Execute".
7. Once it's completed, refresh your database (or log out and back in) and you should see : ACCOUNT_DBF, CHARACTER_01_DBF, ITEM_DBF, LOG_01_DBF, LOGGING_01_DBF, and RANKING_DBF.
Website Scripts
Spoiler:
SQL Injection Protection Script + Guide
Spoiler:
Step 1. Make a file called functions.php
Put this code inside it.
Then, put this at the beginning of every stand-alone php file on your site(ones that aren't linked to index.php).PHP Code:function mssql_escape($str){
$str = htmlentities($str);
if (ctype_alnum($str))
return $str;
else
return str_ireplace(array(';', '%', "'"), "", $str);
}
That's it. There are a lot of other methods of this, array_map, hex packing, individualized sanitizing functions, etc. I wrote that on the spot so feel free to correct anything.PHP Code:include 'functions.php';
foreach ($_GET as $key=>$getvar){ $_GET[$key] = mssql_escape($getvar); }
foreach ($_POST as $key=>$postvar){ $_POST[$key] = mssql_escape($postvar); }
If you want to let people use ' or any other special characters, you probably want to look into a function like this:
which ends up being a lot cleaner of a solution, but they both work fine for me. I'm not sure if it works in ODBC, which is what I use now, but feel free to use it on direct mssql connections.PHP Code:function mssql_escape($data) {
if(is_numeric($data))
return $data;
$unpacked = unpack('H*hex', $data);
return '0x' . $unpacked['hex'];
}
Basic Registration Script
Spoiler:
Registration Script
Just copy and paste this into your registration page. If you have any questions, or know any bugs, please post them here and I will fix them.
Code:<?php $link = @mssql_connect("SERVER IP", "USER", "PASSWORD") or die ("Server is not available!"); $db = @mssql_select_db('ACCOUNT_DBF') or die ("Accout table is missing!"); function doesUsernameExist($name){ $exit = FALSE; $result = @mssql_query("SELECT * FROM dbo.ACCOUNT_TBL WHERE account='$name'"); if(mssql_num_rows($result) != 0){ $exit = TRUE; } else{ $exit = FALSE; } return $exit; } if(!isset($_POST['submit'])){ printSign(""); } else if(isset($_POST['submit'])){ $userRev = preg_replace ("[^A-Za-z0-9]", "", $_POST['username']); $passRev = preg_replace ("[^A-Za-z0-9]", "", $_POST['password']); $day = (int) $_POST['day']; $month = (int) $_POST['month']; $year = (int) $_POST['year']; $email = $_POST['email']; if(empty($_POST['username'])){ printSign("Please enter an account name."); } else if(empty($_POST['email'])){ printSign("Please enter an e-mail address."); } else if(empty($_POST['password'])){ printSign("Please enter a password."); } else if(empty($day) || empty($month) || empty($year) || strlen($day) > 2 || strlen($month) > 2 || strlen($year) != 4 || $day == 00 || $month == 00 || $year == 0000){ printSign("Please enter your birth day."); } else if(strlen($_POST['username']) > 15){ printSign("Your username cannot contain more than 15 characters!"); } else if(strlen($_POST['password']) > 36){ printSign("Your password cannot contain more than 36 characters!"); } else if($_POST['username'] != $userRev){ printSign("Your username contains illegal characters and/or words!"); } else if($_POST['password'] != $passRev){ printSign("Your password contains illegal characters!"); } else if(strlen(filter_var($email, FILTER_VALIDATE_EMAIL)) == 0){ printSign("Your is e-mail is incorrect, please check it!"); } else { if ($resp->is_valid) { $userRev = strtolower($userRev); $passRev = strtolower($passRev); $bday = $month.'/'.$day.'/'.$year; $email = $_POST['email']; $salt = "gamingsync"; $passRev = md5($salt.$passRev); if(!doesUsernameExist($userRev)){ $stmt = mssql_init('dbo.webCreateAcc', $link); mssql_bind($stmt, '@account', $userRev, SQLVARCHAR, false, false, 15); mssql_bind($stmt, '@password', $passRev, SQLVARCHAR, false, false, 36); mssql_bind($stmt, '@birthday', $bday, SQLVARCHAR, false, false, 120); mssql_bind($stmt, '@email', $email, SQLVARCHAR, false, false, 120); mssql_execute($stmt) or die ("Error with the execution."); mssql_free_statement($stmt); printSign('<font color="black">Thank you for registering with the name '.$userRev.'.</font>'); } else { printSign("Username is already taken!"); } } } } } function printSign($alert){ ?> <html> <body> <div align="center"> <h1><u>ENTER SERVER NAME</u></h1> <?php if($alert != ''){ echo '<h2><font color="red">'.$alert.'</font></h2>'; } ?> <form action="flyffregister.php" method="post"> <table> <tr> <td>Username :</td> <td><input size="20" name="username" maxlength="15" type="text"></td> <td>(A-Z, a-z, 1-9)</td> </tr> <tr> <td>Password :</td> <td><input size="20" name="password" maxlength="35" type="password"></td> <td>(A-Z, a-z, 1-9)</td> </tr> <tr> <td>E-mail :</td> <td><input size="20" name="email" maxlength="255" type="text"></td> </tr> <tr> <td>Birth day :</td> <td><input size="1" name="month" maxlength="2" type="text" value="MM"> <input size="1" name="day" maxlength="2" type="text" value="DD"> <input size="3" name="year" maxlength="4" type="text" value="YYYY"></td> </tr> </table> <input type="submit" name="submit" value="register" /> </form> Copyright 2009 © <a href="http://forum.furiazone.com/newthread.php?do=postthread&f=74"><b>Rick</b></a>. </div> </body> </html> <?php } ?>
Voting Script
Spoiler:
So here you go, the voting script from TemplarFlyFF, FlyForFuria and CyclopsFlyFF.
It's extremely easy to setup so I won't make a guide for it.
Enjoy.
Download: HERE
Note: This is Spiken's script. He programmed it.
This is NOT made by anyone else.
Login Script
Spoiler:
As the title says, this is a login script that works with the v14 official files. I'm gonna keep it simple, if you want it to do more, feel free to add on to it. This will be a simple base that you can work with
For this tutorial, I'm going to assume you know absolutely nothing about php. I am going to comment my code as much as possible so that (hopefully) by the time you finish reading this, you will have a basic understanding of php.
Don't panic if the sql syntax doesn't make sense at first. It never did for me either. Just copy-paste it and as you work with it, you'll gradually understand more and more of it.
I suggest you use either notepad++ or Adobe Dreamweaver when coding php scripts. If you have your own favorite text editor, you can use that too.
MAKE SURE you remove the semicolon in front of the line that says mssql in php.ini or else this script will not work.
Also, make sure you save this file as index.php or it won't work right. If you know how, you can change the form info and header() code to make it a different page name. Otherwise, just leave it alone and use index.php
Enough of my carrying on, let's start coding. I'll be enclosing my php scripting between html tags. You don't have to code this way, but it allows for more customization (you can put CSS in the header and make the page a different color, you could have a javascript function, etc...).
Anything between /* */ is a comment. So is anything on the same line as // or #
And there you have a basic login script. Feel free to modify this as you see fit. Play around with it, there's lot of fun stuff you can add.PHP Code:<html>
<head>
<title>Flyff Login Page</title>
<?php
//we use < ?php (without the space) to indicate the beginning of a php script. ? > (without the space) ends the script
//all statements in php must be followed by a semicolon (;).
ob_start(); //allows us to use header() for redirection. You'll see this later on in the code
session_start(); //starts a "session". Sessions can store data until the user leaves the site or restarts their browser
//create variables that we will use when we connect to the MSSQL database
$dbhost = 'PCNAME\SQLEXPRESS'; /*replace PCNAME with you computer's name. Found under Control Panel -> System
replace SQLEXPRESS with the instance you created when you installed MSSQL. Most people won't need to change this*/
$dbuser = 'sa'; //MSSQL treats 'sa' as the admin
$dbpass = 'mypass'; //change mypass to reflect your database's password. This is the same password you use for SQL Server Management Studio
mssql_connect($dbhost,$dbuser,$dbpass) or die("could not connect to database");
//tries to connect using our variables. If it can't connect, it tells us and the script ends
mssql_select_db("ACCOUNT_DBF") or die("Could not find account database");
//tries to connect to the ACCOUNT_DBF database. If it can't connect, it tells us and the script ends
?>
</head>
<body>
<?php
//check to see if we are logged in
if ( !(isset($_SESSION['user'])) ) //we do not place a semicolon after if else statements. If we do, the code in the brackets gets ignored OR you get errors
{
/*this code executes if we are not logged in.
If this code is being executed, we must not be logged in. Therefore, we should display a form that we can log in with*/
echo '<form action="index.php" method="post">
Username:
<input name="username" type="text" size="15" />
<br />
Password:
<input name="pass" type="password" size="15" />
<br />
<input name="submit" type="submit" value="Log in" />
</form>
<br />';
//ok, that was alot of code! the above code creates a nice little form we can use to log in. It adds a line break so we can print a message beneath it
echo 'Welcome Guest! Please log in.
<br />'; //let the user know what's going on
echo 'Need an account?
<a href="mypage.php">click Here!</a>
<br />';
//gives the user a chance to make an account if they didn't already have one. Just change mypage.php to the name of your register page.
if ( isset($_POST['submit']) ) //now we start trying to log the user on
{
//map our user's input to some variables. It makes it easier to work with
$username = $_POST['username']; //value of the username field
$password = $_POST['pass']; //value of the password field
//The server stores the password in an md5 ecnryption, so we need to convert the user's password before we can compare
$convertedpass = md5("kikugalanet" . $pass); //using the . puts the strings together and then converts to md5.
//check if a user with the user's username exists
$query = mssql_query("SELECT * FROM ACCOUNT_TBL WHERE account='$username'");
//the above selects all rows where the colum account matches the value of $username
if (mssql_num_rows($query) == 0) //if this statement is true, $query did not select anything, meaning the username provieded was incorrect
{
echo "Incorrect username!";
mssql_close(); //close the connection
}
else //the user exists. we must check their password to see if it matches the one stored in the database
{
$getinfo = mssql_fetch_assoc($query); //gets all the data from the columns for the row where the username column was $username and stores it as an array
//get the password from the server and map it to a variable, so we can work with it easier
$serverpass = $getinfo['password']; /*the password is stored in the array of $getinfo.
Each element of the array $getinfo is a column name in the database (if you don't believe me, view the table in SQL Management Studio).
The values for the elements match the data for their row (where the username column equals $username)*/
if ($serverpass != $convertedpass) //the passwords do not match
{
echo "Incorrect password!";
mssql_close(); //close the connection
}
else //the user has verified their identity. allow them to be logged in
{
$_SESSION['user'] = $username; //create a session for the user, so they stay logged in until they leave the site or close their browser
mssql_close(); //close the connection
header("Location: index.php"); //refreshes this page. The code in the else should now execute.
}
}
}
}
else //we are currently logged on
{
mssql_close(); //close the connection
echo "Welcome " . $_SESSION['user'] . "!"; //welcome the user
//any other code we could want to do while logged in would also go between these braces
}
?>
</body>
</html>
For those of you who are too lazy to read this and just want the file: index.php
If you found this useful, or learned something from it, thank me since I know very few (if any) of you are actually going to credit me in your sites for the code.
Top 50 Ranking Script
Spoiler:
Top 50 Ranking Script
Add the following code to your website, it will display the top 50 ranked characters on your server (excluding owners, admins, and both types of gm's).
Code:<h2><b><U>Top 50 HighScores</U></b></h2> <div id="content"> <div class="post"> <div class="entry"> <p><?php function quetrabajo($job){ if ($job == '0'){ echo "Vagrant"; } if ($job == '1'){ echo "Mercenary"; } if ($job == '2'){ echo "Acrobat"; } if ($job == '3'){ echo "Assist"; } if ($job == '4'){ echo "Magician"; } if ($job == '5'){ echo "Puppeter"; } if ($job == '6'){ echo "Knight"; } if ($job == '7'){ echo "Blade"; } if ($job == '8'){ echo "Jester"; } if ($job == '9'){ echo "Ranger"; } if ($job == '10'){ echo "Ringmaster"; } if ($job == '11'){ echo "billposter"; } if ($job == '12'){ echo "Psykeeper"; } if ($job == '13'){ echo "Elementor"; } if ($job == '14'){ echo "Gatekeeper"; } if ($job == '15'){ echo "Doppler"; } if ($job == '16'){ echo "M-Knight"; } if ($job == '17'){ echo "M-Blade"; } if ($job == '18'){ echo "M-Jester"; } if ($job == '19'){ echo "M-Ranger"; } if ($job == '20'){ echo "M-Ringmaster"; } if ($job == '21'){ echo "M-Billposter"; } if ($job == '22'){ echo "M-Psykeeper"; } if ($job == '23'){ echo "M-Elementor"; } if ($job == '24'){ echo "H-Knight"; } if ($job == '25'){ echo "H-Blade"; } if ($job == '26'){ echo "H-Jester"; } if ($job == '27'){ echo "H-Ranger"; } if ($job == '28'){ echo "H-Ringmaster"; } if ($job == '29'){ echo "H-Billposter"; } if ($job == '30'){ echo "H-Psykeeper"; } if ($job == '31'){ echo "H-Elementor"; } } $contadorn=1; $contadorm=1; $contadorh=1; $normal = array(); $master = array(); $hero = array(); require('./configs/rank_conf.php'); if(!$link){ echo 'configuracion incorrecta'; }else{ if(!db){ echo ' la base de datos no existe'; }else{ $sql = "SELECT TOP 50 * from [CHARACTER_TBL] WHERE m_chAuthority = 'F' ORDER BY m_nLevel DESC"; $result = mssql_query($sql); while($consulta = mssql_fetch_array($result)) { if($consulta['m_nJob']<=15){ $normal[$contadorn]=$consulta['m_szName']; $normal[$contadorn+1]=$consulta['m_nLevel']; $normal[$contadorn+2]=$consulta['m_nJob']; $contadorn= $contadorn+3; }else{ if($consulta['m_nJob']<=15){ $master[$contadorm]=$consulta['m_szName']; $master[$contadorm+1]= $consulta['m_nLevel']; $master[$contadorm+2]=$consulta['m_nJob']; $contadorm= $contadorm+3; }else{ $hero[$contadorh]=$consulta['m_szName']; $hero[$contadorh+1]=$consulta['m_nLevel']; $hero[$contadorh+2]=$consulta['m_nJob']; $contadorh= $contadorh+3; } } } //empezamos a contar los Masters echo '<div align="center"><table width="100%" border="0" cellspacing="0" cellpadding="0";"><tr>'; echo '<td width="37%" style="padding-left:12px;"><b><u>Username</td>'; echo '<td width="16%" style="padding-left:12px;"><b><u>Level</td>'; echo '<td width="47%" style="padding-left:12px;"><b><u>Job</u></b></td>'; echo'</tr>'; echo'<tr>'; for($i=1;$i<$contadorm;$i=$i+1){ echo '<td style="padding-left:12px;">'; if($i>1 and $i%3==0){ quetrabajo($master[$i]); echo "</td></tr><tr>"; }else{ echo $master[$i]."</td>"; } } //acabamos //empezamos a contar los heroes for($i=1;$i<$contadorh;$i=$i+1){ echo '<td style="padding-left:12px;">'; if($i>1 and $i%3==0){ quetrabajo($hero[$i]); echo "</td></tr><tr>"; }else{ echo $hero[$i]."</td>"; } } //acabamos //empezamos a contar los Masters for($i=1;$i<$contadorn;$i=$i+1){ echo '<td style="padding-left:12px;">'; if($i>1 and $i%3==0){ quetrabajo($normal[$i]); echo "</td></tr><tr>"; }else{ echo $normal[$i]."</td>"; } } echo '</tr>'; //acabamos } } mssql_close(); ?> <tr><td></td><td><br><br><div align="center" style="font-size:12;font-color:#666;"></div></td></tr></table></div></p> </div> </div> </div>
Websites (non scripted)
Spoiler:
x2Fast4YouX Website
Spoiler:
Code:• Credit goes to me for Design/Idea/Coding • Menu is Fully flash • Register / Server Status / Etc. scripts are NOT included • Read "Readme.txt" for more details/config about the web Since this is my 1st "Web" release, I wouldnt want people in this thread saying the design is sh*t. Cheers. -------------------------- Links: [Megaupload] http://www.megaupload.com/?d=KXLYIEZ6 [Rapidshare] http://rapidshare.com/files/355063929/FNGH.rar Enjoy.
How to allow others to connect to your server?
Spoiler:
Server File Editing
Spoiler:
1. Find your "Program Folder", open it.
2. Open accountserver.ini.
3. You need to change both of the following IP's to your hosting IP (to find out your IP, click HERE)
toCode:AddTail( -1, 1, "Test", "127.0.0.1", 0, 1, 0 ); AddTail( 1, 1, "Channel - 1", "127.0.0.1", 1, 1, 600 ); AddTail( 1, 1, "Channel - 2", "127.0.0.1", 0, 1, 600 );
4. Save accountserver.ini, then close it.Code:AddTail( -1, 1, "Test", "YOUR IP ADDRESS", 0, 1, 0 ); AddTail( 1, 1, "Channel - 1", "YOUR IP ADDRESS", 1, 1, 600 ); AddTail( 1, 2, "Channel - 2", "YOUR IP ADDRESS", 0, 1, 600 );
5. Open loginserver.ini.
6. Find the follow code, and replace it accordingly.
toCode:AddCache( "127.0.0.1" );
7. Save loginserver.ini, then you're done!Code:AddCache( "YOUR IP ADDRESS" );
Note : Be sure to allow external connections via account server application, to do so, click the "Tool(L)" button located at the top of the application, and check the "Allow External Connections" option.
How to test
Spoiler:
If you want the accountserver to be automatically set to allowing connections, add TEST above or below the addtail. eg:Note : Do not forget to takeout "TEST" when you're running your server for real.Code:TEST AddTail( -1, 1, "Test", "127.0.0.1", 0, 1, 0 ); AddTail( 1, 1, "Channel - 1", "127.0.0.1", 1, 1, 600 ); AddTail( 1, 1, "Channel - 2", "127.0.0.1", 0, 1, 600 );
Ports
Spoiler:This is a list of the ports you must portforward :
Code:World 15400 Char 23000 Login 28000
Useful Queries
Spoiler:
Basic Queries
Spoiler:
Code://Makes a character any AUTH you want e.x. P z update [CHARACTER_TBL] set m_chAUTHORITY = 'AUTH' where m_szName = 'CHARACTERNAME' //Shows all accounts from latest IP select account from [ACCOUNT_TBL] where lastip = 'IP ADDRESS' //Shows accounts IP select ip from [ACCOUNT_TBL_DETAIL] where account = 'ACCOUNTNAME' //Sets Ban Start Time update [ACCOUNT_TBL_DETAIL] set BlockTime = '20090210' where account = 'ACCOUNTNAME' //Sets Ban End Time update [ACCOUNT_TBL_DETAIL] set EndTime = '' where account = 'ACCOUNTNAME' //Removes the guild wait time on a certain character update [CHARACTER_TBL] set m_tGuildMember = '' where m_szName = 'CHARACTERNAME' //Gets a character's account ID select account from [CHARACTER_TBL] where m_szName = 'CHARACTER NAME' //Displays all the characters on an account select m_szName from [CHARACTER_TBL] where account = 'ACCOUNTNAME' //Sets an IP address on a certain account update [ACCOUNT_TBL_DETAIL] set ip = 'IP ADDRESS' where account = 'ACCOUNTNAME' //Gets the MD5 Password from an account select password from [ACCOUNT_TBL] where account = 'ACCOUNTNAME' //Sets an account's password to what you want it as. update [ACCOUNT_TBL] set password = 'md5 pw' where account = 'ACCOUNTNAME' //Changes the account a character is on (you may need the next query if you use this query) update [CHARACTER_TBL] set account = 'ACCOUNTNAME' where m_szName = 'CHARACTERNAME' //Changes the slot that the player is in in the character selection update [CHARACTER_TBL] set playerslot = 'slot' where m_szName = 'CHARACTERNAME' //Sends an item to a player's inventory mssql_query("INSERT into [ITEM_SEND_TBL](m_idPlayer, serverindex, Item_Name, Item_count, m_nAbilityOption, idSender, ItemFlag, ReceiveDt, ProvideDt, nRandomOptItemId,adwItemId4) VALUES ('CHARACTER ID', '01', 'ITEM NAME', 'ITEM COUNT', 0, '000000', 0, getdate(), NULL, 0, 0);");
Future Update List :
-Registration Script that logs all sql attempts (current one is just ant-sql injectable, basic script)
-v14 server files (with cs seller added, but no items in shop)
-Guide to editing shops
-User CP (anti sql injectable)
-Complete server setup guide
Note : If you have any questions, post them here. If you have any requests, post them here. More will constantly be added, so please request it, or be patient.
Extra Credits
Note : Some of this isn't my work, the work belongs to those in credits.Code:How to Test - DragonLord *Safe* Voting Script - Spikensbror *Safe* Login Script - ryuchao009 *Safe - just a base, so needs customizing and anti-sql function added* x2Fast4YouX Website - x2Fast4YouX *Safe* SQL Injection Script + Protection - Mootie *Safe*



![[Guide & Release] Useful Information, Scripts, Files [Good Releases ONLY]](http://ragezone.com/hyper728.png)


