[Release] Pokemon-Area based browser game

[Raftaar]

panel has about 67% of all the bugs

u fill fix 39% of them in the panel after adding this
include("includes/security.php");

- - - Updated - - -

I have started working on the tournament ...
i will share after fixing it

- - - Updated - - -

and in the rest filter every post and get variables with mysql real escape string it will fix 88% of all the bugs
and for few you need to add a script ;)

- - - Updated - - -

there are 2% of them are in account.php

- - - Updated - - -

so just filter all with
mysql_real_escape_string()

- - - Updated - - -

and the shoutbox also has

- - - Updated - - -

 
<?php
#Script laden zodat je nooit pagina buiten de index om kan laden
include("includes/security.php");


$page = 'bank';
#Goeie taal erbij laden voor de page
include_once('language/language-pages.php');



    
#ALs er al een speler naam binnenkomt met een GET, deze laden
if(isset($_GET['player'])) $spelernaam = $_GET['player'];
else $spelernaam = $_POST['gebruiker'];
    
#Word er op de storten knop gedrukt..
if(!empty($_POST['storten'])){
  #Eventuele komma vervangen door punt
 $bedrag =  mysql_real_escape_string($_POST['stort']);
  #Mag de speler nog wel storten?
  if($gebruiker['storten'] == 0)
    $bericht_stort = '<div class="red">'.$txt['alert_no_more_storting'].'</div>';
  #Is er wel een bedrag ingevoerd?
  elseif(empty($_POST['stort']))
    $bericht_stort = '<div class="red">'.$txt['alert_nothing_insert'].'</div>';
  #is er wel een silverig bedrag ingevoerd?
  elseif(preg_match('/[A-Za-z_]+$/',$_POST['stort']))
    $bericht_stort = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  
  #Kijken als het ingevoerde bedrag wel meer dan 0 is
  elseif($bedrag < 0)
    $bericht_stort = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Is er wel een silverig bedrag ingevoerd?
  elseif(!is_numeric($bedrag))
    $bericht_stort = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
elseif(!preg_match ("/^\d+$/",$_POST['stort']))
    $bericht_stort = '<div class="red">Please Enter Numeric Numbers Only</div>';
  #Heeft de speler wel zoveel silver contant?
  elseif($gebruiker['silver'] < $bedrag)
    $bericht_stort = '<div class="red">'.$txt['alert_too_less_cash'].'</div>';
  #Is alles goed:
  else{
    #Als alles goed is het silver overmaken
    $bericht_stort = '<div class="green">'.$txt['success_stort'].'</div>';
    #Save
    mysql_query("UPDATE `gebruikers` SET `silver`=`silver`-'".$bedrag."', `bank`=`bank`+'".$bedrag."', `storten`=`storten`-'1' WHERE `user_id`='".$_SESSION['id']."'");
  }
}


#word er op de ophalen knop gedrukt?
if(!empty($_POST['ophalen'])){
  $bedrag =  mysql_real_escape_string($_POST['ophaal']);


  #Is er wel een bedrag ingevoerd?
  if(empty($_POST['ophaal']))
    $bericht_ophaal = '<div class="red">'.$txt['alert_nothing_insert'].'</div>';
  #is er wel een silverig bedrag ingevoerd?
  elseif(preg_match('/[A-Za-z_]+$/',$_POST['ophaal']))
    $bericht_ophaal = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Kijken als het ingevoerde bedrag wel meer dan 0 is
  elseif($bedrag < 0)
    $bericht_ophaal = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Is er wel een silverig bedrag ingevoerd?
  elseif(!is_numeric($bedrag))
    $bericht_ophaal = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Heeft de speler wel zoveel silver contant?
  elseif($gebruiker['bank'] < $bedrag)
    $bericht_ophaal = '<div class="red">'.$txt['alert_too_less_bank'].'</div>';
  #Als alles goed is het silver overmaken
  else{
    #Er is een antwoord en het bericht opstellen
    $bericht_ophaal = '<div class="green">'.$txt['success_take'].'</div>';
    #Save
    mysql_query("UPDATE `gebruikers` SET `silver`=`silver`+'".$bedrag."', `bank`=`bank`-'".$bedrag."' WHERE `user_id`='".$_SESSION['id']."'");
  }
}


#Als er silver of gold naar een ander gestuurd word
if(isset($_POST['naargebruiker'])){
  #Eventuele komma vervangen door punt
  if($_POST['what'] == 'silver') $what = 'silver';
  else $what = 'gold';
  $bedrag =  mysql_real_escape_string($_POST['send_amount']);
  
  #Is er wel een ontvanger?
  if(empty($_POST['gebruiker']))
    $bericht_send = '<div class="red">'.$txt['alert_no_receiver'].'</div>';  
  #Niets ingevoerd?
  elseif($bedrag == 0)
      $bericht_send = '<div class="red">'.$txt['alert_nothing_insert'].'</div>'; 
  #Niets ingevoerd?
  elseif(($what != 'silver') && ($what != 'gold'))
      $bericht_send = '<div class="red">'.$txt['alert_no_silver_or_gold'].'</div>'; 
  #Ben je zelf de ontvanger?
  elseif($_SESSION['naam'] ==  mysql_real_escape_string($_POST['gebruiker']))
    $bericht_send = '<div class="red">You Cannot Send Silver/Gold To Yourself</div>';  
  #Bestaat de ontvanger wel?
  elseif(mysql_num_rows(mysql_query("SELECT `user_id` FROM `gebruikers` WHERE `username`='". mysql_real_escape_string($_POST['gebruiker'])."'")) == 0)
    $bericht_send = '<div class="red">'.$txt['alert_receiver_dont_exist'].'</div>';
  #is er wel een bedrag ingevoerd?
  elseif(preg_match('/[A-Za-z_]+$/',$bedrag))
    $bericht = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Kijken als het ingevoerde bedrag wel meer dan 0 is
  elseif($bedrag < 0)
    $bericht_send = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Is er wel een silverig bedrag ingevoerd?
  elseif(!is_numeric($bedrag))
    $bericht_send = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';  
  #is het bedrag wel 10 of groter?
  elseif(($what == 'silver') && (($bedrag != 0) && ($bedrag < 10)))
    $bericht_send = '<div class="red">'.$txt['alert_more_than_10silver'].'</div>';
  #Heeft de speler wel zo veel silver contant
  elseif(($what == 'silver') && ($gebruiker['silver'] < $bedrag))
    $bericht_send = '<div class="red">'.$txt['alert_too_less_money'].'</div>';
  #Heeft de speler wel zo veel gold contant
  elseif(($what == 'gold') && ($gebruiker['gold'] < $bedrag))
    $bericht_send = '<div class="red">'.$txt['alert_too_less_gold'].'</div>';


  else{
    #Message
    $bericht_send = '<div class="green">'.$txt['success_send'].'</div>';
    #silver bij jezelf verminderen
    if($what == 'silver'){
        mysql_query("UPDATE `gebruikers` SET `silver`=`silver`-'".$bedrag."' WHERE `user_id`='".$_SESSION['id']."'");
        #5% van het bedrag afhalen
        $bedrag = $bedrag-ceil($bedrag*0.05);
        #silver bij de tegen party ophogen
        mysql_query("UPDATE `gebruikers` SET `silver`=`silver`+'".$bedrag."' WHERE `username`='". mysql_real_escape_string($_POST['gebruiker'])."'");
        $sg = 'silver';
    }
    else{
        mysql_query("UPDATE `gebruikers` SET `gold`=`gold`-'".$bedrag."' WHERE `user_id`='".$_SESSION['id']."'");
        mysql_query("UPDATE `gebruikers` SET `gold`=`gold`+'".$bedrag."' WHERE `username`='". mysql_real_escape_string($_POST['gebruiker'])."'");
        $sg = 'gold';
    }
        ###Event
        $select = mysql_fetch_assoc(mysql_query("SELECT user_id, land FROM gebruikers WHERE username = '". mysql_real_escape_string($_POST['gebruiker'])."'"));
        
        #Taal pack includen
        $eventlanguage = GetEventLanguage($select['land']);
        include('language/events/language-events-'.$eventlanguage.'.php');
                
        #Bericht opstellen na wat de language van de user is
        $event = '<img src="http://forum.ragezone.com/images/icons/blue.png" width="16" height="16" class="imglower" /> <a href="?page=profile&player='.$gebruiker['username'].'">'.$gebruiker['username'].'</a> '.$txt['event_gave_you'].' <img src="http://forum.ragezone.com/images/icons/'.$sg.'.png" title="'.$sg.'" width="16" height="16" class="imglower"> '.highamount($bedrag).' '.$sg.'.';
                
        #Melding geven aan de uitdager
        mysql_query("INSERT INTO gebeurtenis (id, datum, ontvanger_id, bericht, gelezen)
        VALUES (NULL, NOW(), '".$select['user_id']."', '".$event."', '0')");
  }
}
#Als er silver of gold naar clan wordt gestuurd
if(isset($_POST['naarclan'])){
  #Eventuele komma vervangen door punt
  if($_POST['what'] == 'silver') $what = 'silver';
  else $what = 'gold';
  $bedrag =  mysql_real_escape_string($_POST['clan_stort']);
  
  #Niets ingevoerd?
  if($bedrag == 0)
      $bericht_send2 = '<div class="red">'.$txt['alert_nothing_insert'].'</div>'; 
  #Niets ingevoerd?
  elseif(($what != 'silver') && ($what != 'gold'))
      $bericht_send2 = '<div class="red">'.$txt['alert_no_silver_or_gold'].'</div>'; 
  #is er wel een bedrag ingevoerd?
  elseif(preg_match('/[A-Za-z_]+$/',$bedrag))
    $bericht = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Kijken als het ingevoerde bedrag wel meer dan 0 is
  elseif($bedrag < 0)
    $bericht_send2 = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';
  #Is er wel een silverig bedrag ingevoerd?
  elseif(!is_numeric($bedrag))
    $bericht_send2 = '<div class="red">'.$txt['alert_amount_unknown'].'</div>';  
  #is het bedrag wel 10 of groter?
  elseif(($what == 'silver') && (($bedrag != 0) && ($bedrag < 10)))
    $bericht_send2 = '<div class="red">'.$txt['alert_more_than_10silver'].'</div>';
  #Heeft de speler wel zo veel silver contant
  elseif(($what == 'silver') && ($gebruiker['silver'] < $bedrag))
    $bericht_send2 = '<div class="red">'.$txt['alert_too_less_money'].'</div>';
  #Heeft de speler wel zo veel gold contant
  elseif(($what == 'gold') && ($gebruiker['gold'] < $bedrag))
    $bericht_send2 = '<div class="red">'.$txt['alert_too_less_gold'].'</div>';


  else{
    #Message
    $bericht_send2 = '<div class="green">Successfully transferred to your clan</div>';
    #silver bij jezelf verminderen
    if($what == 'silver'){
        mysql_query("UPDATE `gebruikers` SET `silver`=`silver`-'".$bedrag."' WHERE `user_id`='".$_SESSION['id']."'");
        #silver bij de tegen party ophogen
        mysql_query("UPDATE clans SET clan_silver = clan_silver+'".$bedrag."' WHERE clan_naam = '".$gebruiker['clan']."'");
        $sg = 'silver';
    }
    else{
        mysql_query("UPDATE `gebruikers` SET `gold`=`gold`-'".$bedrag."' WHERE `user_id`='".$_SESSION['id']."'");
        mysql_query("UPDATE clans SET clan_gold = clan_gold+'".$bedrag."' WHERE clan_naam = '".$gebruiker['clan']."'");
        $sg = 'gold';
    }
        ###Event
        $select = mysql_fetch_assoc(mysql_query("SELECT clan_ownerid FROM clans WHERE clan_naam = '".$gebruiker['clan']."'"));
            
        #Bericht opstellen na wat de language van de user is
        $event = '<img src="http://forum.ragezone.com/images/icons/blue.png" width="16" height="16" class="imglower" /> <a href="?page=profile&player='.$gebruiker['username'].'">'.$gebruiker['username'].'</a> heeft <img src="http://forum.ragezone.com/images/icons/'.$sg.'.png" title="'.$sg.'" width="16" height="16" class="imglower"> '.highamount($bedrag).' '.$sg.' deposited into your clan.';
                
        #Melding geven aan de uitdager
        mysql_query("INSERT INTO gebeurtenis (id, datum, ontvanger_id, bericht, gelezen)
        VALUES (NULL, NOW(), '".$select['clan_ownerid']."', '".$event."', '0')");
  }
}


?>
<script language="JavaScript" type="text/javascript" src="javascripts/numeriek.js"></script>
<center>
  <font size="4"><?php echo $txt['title_text_1']; ?><b> <img src="http://forum.ragezone.com/images/icons/silver.png" title="Silver" />  <? echo $silver; ?></b> | <?php echo $txt['title_text_2']; ?><b> <img src="http://forum.ragezone.com/images/icons/silver.png" title="Silver" /> <? echo $bank; ?></b></font>
  <br>
  <font size="2"><?php echo $txt['title_text_3'].' '.$gebruiker['storten'].' '.$txt['title_text_4']; ?></font>
</center>
<hr>
<form method="post">
    <?php if($bericht_stort) echo $bericht_stort; ?>
    <center>
    <table width="300" border="0">
      <tr>
        <td width="150"><label for="stort"><img src="http://forum.ragezone.com/images/icons/silver.png" width="16" height="16" alt="Silver" style="margin-bottom:-3px;" /> <?php echo $txt['amount_silver']; ?></label></td>
        <td width="150"><input type="text" name="stort" value="" id="stort" class="text_long" onKeyPress="onlyNumeric(arguments[0])"/></td>
      </tr>
      <tr>
        <td>&nbsp;</td>
        <td><input type="submit" name="storten" value="<?php echo $txt['button_stort']; ?>" class="button" /></td>
      </tr>
    </table>
  </center>
  <br />
  <?php if($bericht_ophaal) echo $bericht_ophaal; ?>
  <center>
    <table width="300" border="0">
      <tr>
        <td width="150"><label for="ophaal"><img src="http://forum.ragezone.com/images/icons/silver.png" width="16" height="16" alt="Silver" style="margin-bottom:-3px;" /> <?php echo $txt['amount_silver']; ?></label></td>
        <td width="150"><input type="text" name="ophaal" value="" id="ophaal" class="text_long" onKeyPress="onlyNumeric(arguments[0])"/></td>
      </tr>
      <tr>
        <td >&nbsp;</td>
        <td ><input type="submit" name="ophalen" value="<?php echo $txt['button_take']; ?>" class="button" /></td>
      </tr>
    </table>
  </center>
</form>
<center><?php echo $txt['title_text_send']; ?></center>
<hr>
<?php if($bericht_send) echo $bericht_send; ?>
<center>
  <form method="post">
    <table width="300" border="0">
      <tr>
        <td><label for="player"><img src="http://forum.ragezone.com/images/icons/user.png" width="16" height="16" alt="User" style="margin-bottom:-3px;" /> <?php echo $txt['username']; ?></label></td>
        <td colspan="2"><input type="text" name="gebruiker" value="<? if($_GET['player'] != '') echo $_GET['player'];
                                                                      else echo $spelernaam; ?>" id="player" class="text_long" maxlength="10" /></td>
      </tr>
      <tr>
        <td width="150"><label for="silver"><img src="http://forum.ragezone.com/images/icons/vraag.png" width="16" height="16" alt="Silver/Gold" style="margin-bottom:-3px;" /> <?php echo $txt['silver_or_gold']; ?></label></td>
        <td width="50"><input type="radio" name="what" value="silver" id="silver" <?php if($_POST['what'] != 'gold') echo 'checked'; ?> /> <label for="silver"><img src="http://forum.ragezone.com/images/icons/silver.png" alt="Silver" title="Silver" width="16" height="16" /></label></td>
        <td width="100"><input type="radio" name="what" value="gold" id="gold" <?php if($_POST['what'] == 'gold') echo 'checked'; ?> /> <label for="gold"><img src="http://forum.ragezone.com/images/icons/gold.png" alt="Gold" title="Gold" width="16" height="16" /></label>
      </tr>
      <tr>
        <td><label for="send_amount"><img src="http://forum.ragezone.com/images/icons/silver-gold.png" width="16" height="16" alt="Silver/Gold" style="margin-bottom:-3px;" /> <?php echo $txt['amount']; ?></label></td>
        <td colspan="2"><input type="text" name="send_amount" value="<?php if(isset($_POST['send_amount'])) echo $_POST['send_amount']; ?>" id="send_amount" class="text_long" onKeyPress="onlyNumeric(arguments[0])"/></td>
      </tr>
      <tr>
        <td>&nbsp;</td>
        <td colspan="2"><input type="submit" name="naargebruiker" value="<?php echo $txt['button_send']; ?>" class="button" /></td>
      </tr>
    </table>
  </form>
</center>
<?php 
$clanquery = mysql_query("SELECT * FROM clans WHERE clan_naam='".$gebruiker['clan']."'");
$profiel = mysql_fetch_array($clanquery);
if($gebruiker['clan'] != ""){
?>
<center><?php echo '<font size="4"><hr>Deposit to your clan</font><br><font size="2">'.$gebruiker['clan'].'</font><br />'; ?></center>
<hr>
<?php if($bericht_send2) echo $bericht_send2; ?>
<center>
  <form method="post">
    <table width="300" border="0">
      <tr>
        <td width="150"><label for="silver"><img src="http://forum.ragezone.com/images/icons/vraag.png" width="16" height="16" alt="Silver/Gold" style="margin-bottom:-3px;" /> <?php echo $txt['silver_or_gold']; ?></label></td>
        <td width="50"><input type="radio" name="what" value="silver" id="silver" <?php if($_POST['what'] != 'gold') echo 'checked'; ?> /> <label for="silver"><img src="http://forum.ragezone.com/images/icons/silver.png" alt="Silver" title="Silver" width="16" height="16" /></label></td>
        <td width="100"><input type="radio" name="what" value="gold" id="gold" <?php if($_POST['what'] == 'gold') echo 'checked'; ?> /> <label for="gold"><img src="http://forum.ragezone.com/images/icons/gold.png" alt="Gold" title="Gold" width="16" height="16" /></label>
      </tr>
      <tr>
        <td><label for="clan_stort"><img src="http://forum.ragezone.com/images/icons/silver-gold.png" width="16" height="16" alt="Silver/Gold" style="margin-bottom:-3px;" /> <?php echo $txt['amount']; ?></label></td>
        <td colspan="2"><input type="text" name="clan_stort" value="<?php if(isset($_POST['clan_stort'])) echo $_POST['clan_stort']; ?>" id="clan_stort" class="text_long" onKeyPress="onlyNumeric(arguments[0])"/></td>
      </tr>
      <tr>
        <td>&nbsp;</td>
        <td colspan="2"><input type="submit" name="naarclan" value="<?php echo $txt['button_send']; ?>" class="button" /></td>
      </tr>
    </table>
  </form>
</center>
<?php
}
?>

Fixed bank .. with no exploits and bugs fixed like send money to yourself and all

- - - Updated - - -

I need to refresh for each turn in battles
Please help

- - - Updated - - -

add this in index.php
snowy effect

<script language="javascript">
var snowStorm = null;


function SnowStorm() {


  // --- PROPERTIES ---


  this.flakesMax = 128;           // Limit total amount of snow made (falling + sticking)
  this.flakesMaxActive = 64;      // Limit amount of snow falling at once (less = lower CPU use)
  this.animationInterval = 33;    // Theoretical "miliseconds per frame" measurement. 20 = fast + smooth, but high CPU use. 50 = more conservative, but slower
  this.flakeBottom = null;        // Integer for Y axis snow limit, 0 or null for "full-screen" snow effect
  this.targetElement = null;      // element which snow will be appended to (document body if null/undefined) - can be an element ID string, or a DOM node reference
  this.followMouse = true;        // Snow will change movement with the user's mouse
  this.snowColor = '#fff';        // Don't eat (or use?) yellow snow.
  this.snowCharacter = '&bull;';  // &bull; = bullet, &middot; is square on some systems etc.
  this.snowStick = true;          // Whether or not snow should "stick" at the bottom. When off, will never collect.
  this.useMeltEffect = true;      // When recycling fallen snow (or rarely, when falling), have it "melt" and fade out if browser supports it
  this.useTwinkleEffect = false;  // Allow snow to randomly "flicker" in and out of view while falling
  this.usePositionFixed = false;  // true = snow not affected by window scroll. may increase CPU load, disabled by default - if enabled, used only where supported


  // --- less-used bits ---


  this.flakeLeftOffset = 0;       // amount to subtract from edges of container
  this.flakeRightOffset = 0;      // amount to subtract from edges of container
  this.flakeWidth = 8;            // max pixel width for snow element
  this.flakeHeight = 8;           // max pixel height for snow element
  this.vMaxX = 5;                 // Maximum X velocity range for snow
  this.vMaxY = 4;                 // Maximum Y velocity range
  this.zIndex = 0;                // CSS stacking order applied to each snowflake


  // --- End of user section ---


  // jslint global declarations
  /*global window, document, navigator, clearInterval, setInterval */


  var addEvent = (typeof(window.attachEvent)=='undefined'?function(o,evtName,evtHandler) {
    return o.addEventListener(evtName,evtHandler,false);
  }:function(o,evtName,evtHandler) {
    return o.attachEvent('on'+evtName,evtHandler);
  });


  var removeEvent = (typeof(window.attachEvent)=='undefined'?function(o,evtName,evtHandler) {
    return o.removeEventListener(evtName,evtHandler,false);
  }:function(o,evtName,evtHandler) {
    return o.detachEvent('on'+evtName,evtHandler);
  });


  function rnd(n,min) {
    if (isNaN(min)) {
      min = 0;
    }
    return (Math.random()*n)+min;
  }


  function plusMinus(n) {
    return (parseInt(rnd(2),10)==1?n*-1:n);
  }


  var s = this;
  var storm = this;
  this.timers = [];
  this.flakes = [];
  this.disabled = false;
  this.active = false;


  var isIE = navigator.userAgent.match(/msie/i);
  var isIE6 = navigator.userAgent.match(/msie 6/i);
  var isOldIE = (isIE && (isIE6 || navigator.userAgent.match(/msie 5/i)));
  var isWin9X = navigator.appVersion.match(/windows 98/i);
  var isiPhone = navigator.userAgent.match(/iphone/i);
  var isBackCompatIE = (isIE && document.compatMode == 'BackCompat');
  var noFixed = ((isBackCompatIE || isIE6 || isiPhone)?true:false);
  var screenX = null;
  var screenX2 = null;
  var screenY = null;
  var scrollY = null;
  var vRndX = null;
  var vRndY = null;
  var windOffset = 1;
  var windMultiplier = 2;
  var flakeTypes = 6;
  var fixedForEverything = false;
  var opacitySupported = (function(){
    try {
      document.createElement('div').style.opacity = '0.5';
    } catch (e) {
      return false;
    }
    return true;
  })();
  var docFrag = document.createDocumentFragment();
  if (s.flakeLeftOffset === null) {
    s.flakeLeftOffset = 0;
  }
  if (s.flakeRightOffset === null) {
    s.flakeRightOffset = 0;
  }


  this.meltFrameCount = 20;
  this.meltFrames = [];
  for (var i=0; i<this.meltFrameCount; i++) {
    this.meltFrames.push(1-(i/this.meltFrameCount));
  }


  this.randomizeWind = function() {
    vRndX = plusMinus(rnd(s.vMaxX,0.2));
    vRndY = rnd(s.vMaxY,0.2);
    if (this.flakes) {
      for (var i=0; i<this.flakes.length; i++) {
        if (this.flakes[i].active) {
          this.flakes[i].setVelocities();
        }
      }
    }
  };


  this.scrollHandler = function() {
    // "attach" snowflakes to bottom of window if no absolute bottom value was given
    scrollY = (s.flakeBottom?0:parseInt(window.scrollY||document.documentElement.scrollTop||document.body.scrollTop,10));
    if (isNaN(scrollY)) {
      scrollY = 0; // Netscape 6 scroll fix
    }
    if (!fixedForEverything && !s.flakeBottom && s.flakes) {
      for (var i=s.flakes.length; i--;) {
        if (s.flakes[i].active === 0) {
          s.flakes[i].stick();
        }
      }
    }
  };


  this.resizeHandler = function() {
    if (window.innerWidth || window.innerHeight) {
      screenX = window.innerWidth-(!isIE?16:2)-s.flakeRightOffset;
      screenY = (s.flakeBottom?s.flakeBottom:window.innerHeight);
    } else {
      screenX = (document.documentElement.clientWidth||document.body.clientWidth||document.body.scrollWidth)-(!isIE?8:0)-s.flakeRightOffset;
      screenY = s.flakeBottom?s.flakeBottom:(document.documentElement.clientHeight||document.body.clientHeight||document.body.scrollHeight);
    }
    screenX2 = parseInt(screenX/2,10);
  };


  this.resizeHandlerAlt = function() {
    screenX = s.targetElement.offsetLeft+s.targetElement.offsetWidth-s.flakeRightOffset;
    screenY = s.flakeBottom?s.flakeBottom:s.targetElement.offsetTop+s.targetElement.offsetHeight;
    screenX2 = parseInt(screenX/2,10);
  };


  this.freeze = function() {
    // pause animation
    if (!s.disabled) {
      s.disabled = 1;
    } else {
      return false;
    }
    for (var i=s.timers.length; i--;) {
      clearInterval(s.timers[i]);
    }
  };


  this.resume = function() {
    if (s.disabled) {
       s.disabled = 0;
    } else {
      return false;
    }
    s.timerInit();
  };


  this.toggleSnow = function() {
    if (!s.flakes.length) {
      // first run
      s.start();
    } else {
      s.active = !s.active;
      if (s.active) {
        s.show();
        s.resume();
      } else {
        s.stop();
        s.freeze();
      }
    }
  };


  this.stop = function() {
    this.freeze();
    for (var i=this.flakes.length; i--;) {
      this.flakes[i].o.style.display = 'none';
    }
    removeEvent(window,'scroll',s.scrollHandler);
    removeEvent(window,'resize',s.resizeHandler);
    if (!isOldIE) {
      removeEvent(window,'blur',s.freeze);
      removeEvent(window,'focus',s.resume);
    }
  };


  this.show = function() {
    for (var i=this.flakes.length; i--;) {
      this.flakes[i].o.style.display = 'block';
    }
  };


  this.SnowFlake = function(parent,type,x,y) {
    var s = this;
    var storm = parent;
    this.type = type;
    this.x = x||parseInt(rnd(screenX-20),10);
    this.y = (!isNaN(y)?y:-rnd(screenY)-12);
    this.vX = null;
    this.vY = null;
    this.vAmpTypes = [1,1.2,1.4,1.6,1.8]; // "amplification" for vX/vY (based on flake size/type)
    this.vAmp = this.vAmpTypes[this.type];
    this.melting = false;
    this.meltFrameCount = storm.meltFrameCount;
    this.meltFrames = storm.meltFrames;
    this.meltFrame = 0;
    this.twinkleFrame = 0;
    this.active = 1;
    this.fontSize = (10+(this.type/5)*10);
    this.o = document.createElement('div');
    this.o.innerHTML = storm.snowCharacter;
    this.o.style.color = storm.snowColor;
    this.o.style.position = (fixedForEverything?'fixed':'absolute');
    this.o.style.width = storm.flakeWidth+'px';
    this.o.style.height = storm.flakeHeight+'px';
    this.o.style.fontFamily = 'arial,verdana';
    this.o.style.overflow = 'hidden';
    this.o.style.fontWeight = 'normal';
    this.o.style.zIndex = storm.zIndex;
    docFrag.appendChild(this.o);


    this.refresh = function() {
      if (isNaN(s.x) || isNaN(s.y)) {
        // safety check
        return false;
      }
      s.o.style.left = s.x+'px';
      s.o.style.top = s.y+'px';
    };


    this.stick = function() {
      if (noFixed || (storm.targetElement != document.documentElement && storm.targetElement != document.body)) {
        s.o.style.top = (screenY+scrollY-storm.flakeHeight)+'px';
      } else if (storm.flakeBottom) {
        s.o.style.top = storm.flakeBottom+'px';
      } else {
        s.o.style.display = 'none';
        s.o.style.top = 'auto';
        s.o.style.bottom = '0px';
        s.o.style.position = 'fixed';
        s.o.style.display = 'block';
      }
    };


    this.vCheck = function() {
      if (s.vX>=0 && s.vX<0.2) {
        s.vX = 0.2;
      } else if (s.vX<0 && s.vX>-0.2) {
        s.vX = -0.2;
      }
      if (s.vY>=0 && s.vY<0.2) {
        s.vY = 0.2;
      }
    };


    this.move = function() {
      var vX = s.vX*windOffset;
      s.x += vX;
      s.y += (s.vY*s.vAmp);
      if (s.x >= screenX || screenX-s.x < storm.flakeWidth) { // X-axis scroll check
        s.x = 0;
      } else if (vX < 0 && s.x-storm.flakeLeftOffset<0-storm.flakeWidth) {
        s.x = screenX-storm.flakeWidth-1; // flakeWidth;
      }
      s.refresh();
      var yDiff = screenY+scrollY-s.y;
      if (yDiff<storm.flakeHeight) {
        s.active = 0;
        if (storm.snowStick) {
          s.stick();
        } else {
          s.recycle();
        }
      } else {
        if (storm.useMeltEffect && s.active && s.type < 3 && !s.melting && Math.random()>0.998) {
          // ~1/1000 chance of melting mid-air, with each frame
          s.melting = true;
          s.melt();
          // only incrementally melt one frame
          // s.melting = false;
        }
        if (storm.useTwinkleEffect) {
          if (!s.twinkleFrame) {
            if (Math.random()>0.9) {
              s.twinkleFrame = parseInt(Math.random()*20,10);
            }
          } else {
            s.twinkleFrame--;
            s.o.style.visibility = (s.twinkleFrame && s.twinkleFrame%2===0?'hidden':'visible');
          }
        }
      }
    };


    this.animate = function() {
      // main animation loop
      // move, check status, die etc.
      s.move();
    };


    this.setVelocities = function() {
      s.vX = vRndX+rnd(storm.vMaxX*0.12,0.1);
      s.vY = vRndY+rnd(storm.vMaxY*0.12,0.1);
    };


    this.setOpacity = function(o,opacity) {
      if (!opacitySupported) {
        return false;
      }
      o.style.opacity = opacity;
    };


    this.melt = function() {
      if (!storm.useMeltEffect || !s.melting) {
        s.recycle();
      } else {
        if (s.meltFrame < s.meltFrameCount) {
          s.meltFrame++;
          s.setOpacity(s.o,s.meltFrames[s.meltFrame]);
          s.o.style.fontSize = s.fontSize-(s.fontSize*(s.meltFrame/s.meltFrameCount))+'px';
          s.o.style.lineHeight = storm.flakeHeight+2+(storm.flakeHeight*0.75*(s.meltFrame/s.meltFrameCount))+'px';
        } else {
          s.recycle();
        }
      }
    };


    this.recycle = function() {
      s.o.style.display = 'none';
      s.o.style.position = (fixedForEverything?'fixed':'absolute');
      s.o.style.bottom = 'auto';
      s.setVelocities();
      s.vCheck();
      s.meltFrame = 0;
      s.melting = false;
      s.setOpacity(s.o,1);
      s.o.style.padding = '0px';
      s.o.style.margin = '0px';
      s.o.style.fontSize = s.fontSize+'px';
      s.o.style.lineHeight = (storm.flakeHeight+2)+'px';
      s.o.style.textAlign = 'center';
      s.o.style.verticalAlign = 'baseline';
      s.x = parseInt(rnd(screenX-storm.flakeWidth-20),10);
      s.y = parseInt(rnd(screenY)*-1,10)-storm.flakeHeight;
      s.refresh();
      s.o.style.display = 'block';
      s.active = 1;
    };


    this.recycle(); // set up x/y coords etc.
    this.refresh();


  };


  this.snow = function() {
    var active = 0;
    var used = 0;
    var waiting = 0;
    var flake = null;
    for (var i=s.flakes.length; i--;) {
      if (s.flakes[i].active == 1) {
        s.flakes[i].move();
        active++;
      } else if (s.flakes[i].active === 0) {
        used++;
      } else {
        waiting++;
      }
      if (s.flakes[i].melting) {
        s.flakes[i].melt();
      }
    }
    if (active<s.flakesMaxActive) {
      flake = s.flakes[parseInt(rnd(s.flakes.length),10)];
      if (flake.active === 0) {
        flake.melting = true;
      }
    }
  };


  this.mouseMove = function(e) {
    if (!s.followMouse) {
      return true;
    }
    var x = parseInt(e.clientX,10);
    if (x<screenX2) {
      windOffset = -windMultiplier+(x/screenX2*windMultiplier);
    } else {
      x -= screenX2;
      windOffset = (x/screenX2)*windMultiplier;
    }
  };


  this.createSnow = function(limit,allowInactive) {
    for (var i=0; i<limit; i++) {
      s.flakes[s.flakes.length] = new s.SnowFlake(s,parseInt(rnd(flakeTypes),10));
      if (allowInactive || i>s.flakesMaxActive) {
        s.flakes[s.flakes.length-1].active = -1;
      }
    }
    storm.targetElement.appendChild(docFrag);
  };


  this.timerInit = function() {
    s.timers = (!isWin9X?[setInterval(s.snow,s.animationInterval)]:[setInterval(s.snow,s.animationInterval*3),setInterval(s.snow,s.animationInterval)]);
  };


  this.init = function() {
    s.randomizeWind();
    s.createSnow(s.flakesMax); // create initial batch
    addEvent(window,'resize',s.resizeHandler);
    addEvent(window,'scroll',s.scrollHandler);
    if (!isOldIE) {
      addEvent(window,'blur',s.freeze);
      addEvent(window,'focus',s.resume);
    }
    s.resizeHandler();
    s.scrollHandler();
    if (s.followMouse) {
      addEvent(document,'mousemove',s.mouseMove);
    }
    s.animationInterval = Math.max(20,s.animationInterval);
    s.timerInit();
  };


  var didInit = false;


  this.start = function(bFromOnLoad) {
    if (!didInit) {
      didInit = true;
    } else if (bFromOnLoad) {
      // already loaded and running
      return true;
    }
    if (typeof s.targetElement == 'string') {
      var targetID = s.targetElement;
      s.targetElement = document.getElementById(targetID);
      if (!s.targetElement) {
        throw new Error('Snowstorm: Unable to get targetElement "'+targetID+'"');
      }
    }
    if (!s.targetElement) {
      s.targetElement = (!isIE?(document.documentElement?document.documentElement:document.body):document.body);
    }
    if (s.targetElement != document.documentElement && s.targetElement != document.body) {
      s.resizeHandler = s.resizeHandlerAlt; // re-map handler to get element instead of screen dimensions
    }
    s.resizeHandler(); // get bounding box elements
    s.usePositionFixed = (s.usePositionFixed && !noFixed); // whether or not position:fixed is supported
    fixedForEverything = s.usePositionFixed;
    if (screenX && screenY && !s.disabled) {
      s.init();
      s.active = true;
    }
  };


  function doStart() {
      s.start(true);
  }


  if (document.addEventListener) {
    // safari 3.0.4 doesn't do DOMContentLoaded, maybe others - use a fallback to be safe.
    document.addEventListener('DOMContentLoaded',doStart,false);
    window.addEventListener('load',doStart,false);
  } else {
    addEvent(window,'load',doStart);
  }


}


snowStorm = new SnowStorm();
</script>

[ThuGie]

Lol

if(!preg_match('/[A-Za-z_]+$/',$_POST['bedrag'])){
$getal = rand(1,99);
$bedrag = highamount($_POST['bedrag']);

Pretty sure bedrag, aka price, should be 0-9 not a-z lol.. test before you post.

if(isset($_GET['player'])) $spelernaam = $_GET['player'];
else $spelernaam = $_POST['gebruiker'];
After that only escape is applied to it, applied doesn't magically protect your query from exploits.. it only escapes ' by making it \'
How about properly applying PDO ?

Also including security.php doesn't magically secure it as well, unless your security.php is different from the one that's in the package, its 0% secure.

[The General]

Lol

if(!preg_match('/[A-Za-z_]+$/',$_POST['bedrag'])){
$getal = rand(1,99);
$bedrag = highamount($_POST['bedrag']);

Pretty sure bedrag, aka price, should be 0-9 not a-z lol.. test before you post.

if(isset($_GET['player'])) $spelernaam = $_GET['player'];
else $spelernaam = $_POST['gebruiker'];
After that only escape is applied to it, applied doesn't magically protect your query from exploits.. it only escapes ' by making it \'
How about properly applying PDO ?

Also including security.php doesn't magically secure it as well, unless your security.php is different from the one that's in the package, its 0% secure.

Well I started working on converting it to PDO. Got through the whole CMS but the only thing that doesnt work for me is the battling part. Which is like 65% of the whole CMS and I cba to recode that all from scratch.

[ThuGie]

I do know what you mean, i have had to recode whole systems, that i didn't write, and where written by people with little knowledge about coding let alone about php..
Took me ages! Hopefully last time at least this year that i have to do that haha.

[Raftaar]

I don't have a proper knowledge of PDO .. But the script runs fine for me

- - - Updated - - -

And no noticeable exploit was found when scanned

[The General]

I don't have a proper knowledge of PDO .. But the script runs fine for me

- - - Updated - - -

And no noticeable exploit was found when scanned

You shouldnt let software scan it. Always test it all by yourself first.

[Raftaar]

Well I know that..
But i had tried most of the bugs like
Unlimited Stuff
Unlimited Money
and stuff like that
Even Buy multiple items at once
etc and many more

- - - Updated - - -

and theres always a simple solution for them

- - - Updated - - -

whats the error in this

 mysql_query("INSERT INTO `pokemon_speler` (`wild_id`, `user_id`, `opzak_nummer`, `karakter`, `trade`, `level`, `levenmax`, `leven`, `expnodig`, `attack`, `defence`, `speed`, `spc.attack`, `spc.defence`, `attack_iv`, `defence_iv`, `speed_iv`, `spc.attack_iv`, `spc.defence_iv`, `hp_iv`, `aanval_1`, `aanval_2`, `aanval_3`, `aanval_4`)       VALUES ('".$add_pokemon['id']."', '".$_SESSION['id']."', 'nee', '".$karakter['karakter_naam']."', '1.5', '50', '".$add_pokemon['hpstat'] ."', '".$add_pokemon['hpstat']."', '".$info['punten']."', '".$add_pokemon['attackstat']."', '".$add_pokemon['defencestat']."', '".$add_pokemon['speedstat']."', '".$add_pokemon['spcattackstat']."', '".$add_pokemon['spcdefencestat']."', '".$attack_iv."', '".$defence_iv."', '".$speed_iv."', '".$spcattack_iv."', '".$spcdefence_iv."', '".$hp_iv."', '".$add_pokemon['aanval1']."', '".$add_pokemon['aanval2']."', '".$add_pokemon['aanval3']."', '".$add_pokemon['aanval4']."')");

- - - Updated - - -

Help Needed ... PROMO CODE

its not adding the pokemon in the pokemon table

NEED HELP

if you make this part work

i will share the other parts of it as well

- - - Updated - - -

code

<?php	//Session Protector
	include("includes/security.php");
	
	$page = 'promotion';
	//Language script ... its not required
	include_once('language/language-pages.php');
	


	if(isset($_POST['submit'])){
	
      
     




if($gebruiker['promo'] > 1){ 
echo '<div class="red">you have already got your promo</div>';
}


else{ 
$promo = mysql_query("SELECT * FROM promos WHERE id='1'");


  $add_sql = mysql_fetch_assoc(mysql_query("SELECT wild_id, naam, aanval_1, aanval_2, aanval_3, aanval_4 FROM pokemon_wild WHERE naam='".$promo['name']."'"));




    $add_pokemon['id']             = $add_sql['wild_id'];
    $add_pokemon['pokemon']        = $add_sql['naam'];
    $add_pokemon['aanval1']        = $add_sql['aanval_1'];
    $add_pokemon['aanval2']        = $add_sql['aanval_2'];
    $add_pokemon['aanval3']        = $add_sql['aanval_3'];
    $add_pokemon['aanval4']        = $add_sql['aanval_4'];
    $klaar          = false;
    $loop           = 0;
    $lastid         = 0;
  //Pokemon IVs
    $attack_iv       = rand(2,31);
    $defence_iv      = rand(2,31);
    $speed_iv        = rand(2,31);
    $spcattack_iv    = rand(2,31);
    $spcdefence_iv   = rand(2,31);
    $hp_iv           = rand(2,31);
  








    //Poke Stats
//Attack Stats
    $add_pokemon['attackstat']     = round((((($info['attack_base']*2+$attack_iv)*5/100)+5)*1)*$karakter['attack_add']);
   


//defense Stat
 $add_pokemon['defencestat']    = round((((($info['defence_base']*2+$defence_iv)*5/100)+5)*1)*$karakter['defence_add']);




//Speed stat
    $add_pokemon['speedstat']      = round((((($info['speed_base']*2+$speed_iv)*5/100)+5)*1)*$karakter['speed_add']);
   
//spc.attack Stat
 $add_pokemon['spcattackstat']  = round((((($info['spc.attack_base']*2+$spcattack_iv)*5/100)+5)*1)*$karakter['spc.attack_add']);




//SPC.Defence stat
    $add_pokemon['spcdefencestat'] = round((((($info['spc.defence_base']*2+$spcdefence_iv)*5/100)+5)*1)*$karakter['spc.defence_add']);


//hp stat
    $add_pokemon['hpstat']         = round(((($info['hp_base']*2+$hp_iv)*5/100)+5)+10);
    




    //Ivs
    //Ivs Randomized between 2 to 15
    $attack_iv       = rand(2,15);
    $defence_iv      = rand(2,15);
    $speed_iv        = rand(2,15);
    $spcattack_iv    = rand(2,15);
    $spcdefence_iv   = rand(2,15);
    $hp_iv           = rand(2,15);
    
//Pokemon moods
    $karakter  = mysql_fetch_assoc(mysql_query("SELECT * FROM `karakters` ORDER BY rand() limit 1"));




//Insert into database
		mysql_query("INSERT INTO `pokemon_speler` (`wild_id`, `user_id`, `opzak`, `karakter`, `trade`, `level`, `levenmax`, `leven`, `expnodig`, `attack`, `defence`, `speed`, `spc.attack`, `spc.defence`, `attack_iv`, `defence_iv`, `speed_iv`, `spc.attack_iv`, `spc.defence_iv`, `hp_iv`, `aanval_1`, `aanval_2`, `aanval_3`, `aanval_4`) 
      VALUES ('".$add_pokemon['id']."', '".$_SESSION['id']."', 'nee', '".$karakter['karakter_naam']."', '1.5', '5', '".$add_pokemon['hpstat'] ."', '".$add_pokemon['hpstat']."', '".$info['punten']."', '".$add_pokemon['attackstat']."', '".$add_pokemon['defencestat']."', '".$add_pokemon['speedstat']."', '".$add_pokemon['spcattackstat']."', '".$add_pokemon['spcdefencestat']."', '".$attack_iv."', '".$defence_iv."', '".$speed_iv."', '".$spcattack_iv."', '".$spcdefence_iv."', '".$hp_iv."', '".$add_pokemon['aanval1']."', '".$add_pokemon['aanval2']."', '".$add_pokemon['aanval3']."', '".$add_pokemon['aanval4']."')") or die(mysql_error());




#Update the promo txt
	mysql_query("UPDATE gebruikers SET promo = promo+'1' WHERE user_id = '".$_SESSION['id']."'");
            mysql_query("UPDATE `gebruikers` SET `aantalpokemon`=`aantalpokemon`+'1' WHERE `user_id`='" . $_SESSION['id'] . "'");


			echo '<div class="green">Congratulations you have got your Pokemon</div>';
}
         
		
	  }
	  
?>
<form method='post'>


<center>
<h2>Promo</h2>
<br />


<input type='submit' name='submit' value='get promo' class='button'>
</from>


<br />
</center>
</form>

[lilsnow]

@Raftaar: what is with the language files? :)

someone have KiruHoshino´s battle system?... download/forum contribution was deleted :/

[Raftaar]

Kiru's battle system just has battle bgs and few extra images .. Which is easy to make ... See the page 24 for it

And what language files..

- - - Updated - - -

admin panel theme gives header error
when used as main layout

[felixcruzer]

Kiru's battle system just has battle bgs and few extra images .. Which is easy to make ... See the page 24 for it

And what language files..

- - - Updated - - -

admin panel theme gives header error
when used as main layout

Screenshot:

Spoiler:

it's a lot work, maybe i switch to metroui..

regards

[KiruHoshino]

Kiru's battle system just has battle bgs and few extra images .. Which is easy to make ... See the page 24 for it

And what language files..

- - - Updated - - -

admin panel theme gives header error
when used as main layout

What you put out an error?

[Raftaar]

.. Huh?

- - - Updated - - -

No what I mean I have tried using admin panel as main layout .. Fixed it properly ...with no error ..
but as admin panel is in bootstrap .. It needs alot of html codes ... Which gives header errors

- - - Updated - - -

Its only cure is meta redirect.. But its slow and won't work on maps or trainer

- - - Updated - - -
@lilsnow will it be fine if i mail you the language files ?

- - - Updated - - -

I don't see any cure for the header's error other than meta redirect

so for now a simple mobile registeration

( Using few parts of the admin panel theme for mobile version)

- - - Updated - - -

http://prntscr.com/2ciwps

- - - Updated - - -
@KiruHoshino this is a header error -> http://prntscr.com/2ciy7d

- - - Updated - - -

which is caused by spaces in php , html before header , alot of HTML

- - - Updated - - -

http://prntscr.com/2cj123 another

[ThuGie]

You really should learn php..

Anyway simply make sure all header(""); calls are made before you send anything else.
so make sure there is no html before header, put it after header, same for echo etc, and js all that stuff.
header should always! be first.

Also in the future when you are getting php error's, don't simply say blabla gives a error. but actually put the error message as ell if you want help.
Without knowing what the error is its going to take a long time before somebody is even gone try to help you.

[Raftaar]

There is only one way to fix this error

IF you are coding the game in bootstrap
or with alot of HTML

USE this

THIS WILL FIX the header redirect error
Screenshot by Lightshot

- - - Updated - - -

I know the RULES OF PHP @ThuGie

I have just started my php lessons few years ago

anyways the ob_start hs fixed my problem

[ThuGie]

First, just started ...few years ago..how is a few years,just..
Anyway.. I see you making posts, saying its secure etc..while it clearly is not.
So, it is nice and all that you are trying to help people, but mention that you just started to work with php a few hours ago. and are still learning.
Example, if you started php a few years ago, you would at least not have to copy/past code from here and there, and by the looks of it, that is what you are doing.

The code should be cleaner, and would be more optimized.

And damn it seems my space bar broke got to press it like 10 times..

Also from your screenshot
Try this:
$gebruiker = mysql_fetch_assoc(mysql_query("SELECT * FROM gebruikers WHERE user_id = '" . $_SESSION['id'] . "' LIMIT 1"));
Notice the limit 1 ?