Various ways you could tackle the bot issue;
Store the last train in a session. Check if they last trained within x seconds. If so, kill the training action.
Third party CAPTCHA tool There are some awesome ones, which aren't just "type the text" ones - as these can be beaten to an extent. reCAPTCHA
SweetCAPTCHA
In short, integrating a third party CAPTCHA solution is pretty easy. Creating your own is a good idea also (maybe), but robots can bypass them - so it could take a while to ensure bots cannot "read" them and humans can - without lowering user experience, and a third party application is probably the safer option - you don't need to develop it, future updates, ...
For the energy to minus a value after training;
print '<div class="suc_msg">You have successfully spent 1 hour of studying the art of fighting!</div>';
$db->query("UPDATE `users` SET `money` = `money` - ".$cost['learn'].", `energy`=`energy`-1 WHERE `userid` = ".$userid);
$db->query("UPDATE `userstats` SET `intelligence` = ".$intelligence.", `endurance` = ".$endurance.", `reflexive` = ".$reflexive." WHERE `userid` = ".$userid);