rockwood

preventing from XSS attacks nothing else

follow the file location :-"nwe\config" file name:-config.php // Database host $dbhost="localhost"; // Database username $dbuser="database username"; // Database password $dbpass="database password"; // Database name $dbname="Databse Name";

i dont think so both are very different in this sprintf("%s",!$_GET['step']) making string values from here in this if(!$_GET['step']) you are chking only like empty due to injection i advised for sprintf

if i did this so it would be like this <?php /*Made by Jcvenom Do not resell this mod Do not claim making this mod*/ /*------------includes--------------*/ include "globals.php"; /*------------includes--------------*/ echo "<center><main>Credit Exchange</main><hr width = '75%'>"; if($ir['jail'] > 1 || $ir['hospital'] > 1) { echo "Sorry this page is not viewable while in jail or hospital!<hr width='75%'/>"; exit($h->endpage()); } $_GET['step'] = sprintf("%s",$_GET['step']); if(!$_GET['step']) { //nowdoc is required here echo " Welcome to the Credit exchange, you can come here to spend your credits on special items & gains such as </br /> will boost and much more! <main>If you don't have any Credits ? <a href='donate.php' target = '_blank'> <font color=brown>Click Here</font></a> to buy Credit Card<hr width = '75%'><table width = '75%' class = 'rounded'><tr><td align = 'center'> <table width = '95%' style = 'font-weight:800;'><tr bgcolor = '#999999'> You have <b>".number_format($ir['credits'])."</b> credits.<hr width = '75%'>"; echo "<table width = '75%' class = 'rounded'><tr><td align = 'center'> <table width = '95%' style = 'font-weight:800;'><tr bgcolor = '#999999'> <td align = 'left'><center><font color=white>Description</td><td align = 'left'><center><font color=white>Info</td><td align = 'left'><center><font color=white>Cost</td></tr> <tr class = 'evens'> <td align = 'left'>• <i>Xanax x 10<td align = 'left'><center> [<a href='cctrade.php?step=xanax'><font color=green>Buy</font></a>]</i></a></td> <td align = 'left'>2 Credits</td> </tr> <tr class = 'evens'> <td align = 'left'>• <i>Happy Boost (+2500)<td align = 'left'><center> [<a href='cctrade.php?step=happy'><font color=green>Buy</font></a>]</i></a></td> <td align = 'left'>6 Credits</td> </tr> <tr class = 'evens'> <td align = 'left'>• <i>Energy boost (+500)<td align = 'left'><center> [<a href='cctrade.php?step=booste'><font color=green>Buy</font></a>]</i></a></td> <td align = 'left'>8 Credits</td> </tr> </table> </td></tr></table> <hr width = '75%'>><a href='explore.php'>Back</a><hr width = '75%'>"; } else { if(!in_array($_GET['step'],array('xanax', 'happy', 'booste'))) { echo "Error, Bad request. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { if(strcmp($_GET['step'],'xanax')=== 0) { if(!$_POST['step']) { echo "<form action = 'cctrade.php?step=xanax' method = 'post'> Are you sure you wish to swap <b>2</b> credits for x10 Xanax? <input type = 'submit' name = 'step' value = 'Continue'> </form> <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { if($ir['credits'] < 2) { echo "Sorry, You dont have enough credits to purchase x10 Xanax. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { try { $db->query("UPDATE `users` SET `credits`=`credits` - '1' WHERE userid=$userid"); $db->query("INSERT INTO inventory VALUES('',ITEMID-HERE,$userid,QUANTITY)"); event_add($ir['userid'],"Success, You have be credited x10 Xanax for 2 credits",$c); } catch (Exception $e) { echo $e->getMessage(); } echo "Success, You have be credited x10 Xanax for 2 credits. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } } } else if(strcmp($_GET['step'],'booste')=== 0) { if(!isset($_POST['step'])) { echo "<form action = 'cctrade.php?step=booste' method = 'post'> Are you sure you wish to swap <b>8</b> credits for 500 energy boost? <i>Note: This is <b><u>not</u></b> an item, You will receive a 500 energy boost for a short time.</i> <input type = 'submit' name = 'step' value = 'Continue'> </form> <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { if($ir['credits'] < 8) { echo "Sorry, You dont have enough credits to purchase a energy boost. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { try { $db->query("UPDATE `users` SET `energy`=`energy` + '500` WHERE userid=$userid"); $db->query("UPDATE `users` SET `credits`=`credits` - '8' WHERE userid=$userid"); event_add($ir['userid'],"You have be credited with 500 energy boost for 8 credits",$c); } catch (Exception $e) { echo $e->getMessage(); } echo "Success, You have be credited with 500 energy boost for 8 credits. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } } } else if(strcmp($_GET['step'],'happy')=== 0) { if(!$_POST['step']) { echo "<form action = 'cctrade.php?step=happy' method = 'post'> Are you sure you wish to swap <b>6</b> credits for 2500 happiness? <i>Note: This is <b><u>not</u></b> an item, You will recieve 2500 happy for a short time.</i> <input type = 'submit' name = 'step' value = 'Continue'> </form> <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { if($ir['credits'] < 6 ) { echo "Sorry, You dont have enough credits to purchase a happy boost. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } else { try { $db->query("UPDATE `users` SET `will`=`will` + '2500' WHERE userid=$userid"); $db->query("UPDATE `users` SET `credits`=`credits` - '6' WHERE userid=$userid"); event_add($ir['userid'],"You have be credited with 2500 happy for 6 credits",$c); } catch (Exception $e) { echo $e->getMessage(); } echo "Success, You have be credited with 2500 happy for 6 credits. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } } } else { echo "Error, Bad request. <hr width = '75%'>><a href='cctrade.php'>Back</a><hr width = '75%'>"; } } } $h->endpage(); ?>   This is not tested

yes, i made from scratch and i am sure it is very unique

can i upload Gym mod as paid work

Congrats !Angel and Good luck

who is the new owner of http://mccodemods.com/ ????

$posts_per_page = 10; $posts_topic = "number of users"; $pages = ceil("total number of rows" / $posts_per_page); $st = isset($_GET['st']) ? $_GET['st'] : 0; if (isset($_GET['lastpost'])) { $st = ($pages - 1) * 10; } $pst = -10; print "Pages: "; for ($i = 1; $i <= $pages; $i++) { $pst += 20; print "<a href='pagename.php?viewusernumber={"current row id"}&st=$pst'>"; if ($pst == $st) { print "<b>"; } print $i; if ($pst == $st) { print "</b>"; } print "</a> "; if ($i % 25 == 0) { print "<br />"; } } you should try something like this

I want it.

yes 100% possible

strip_tags and htmlspecialchars, i wanna add one more

you can add me in testing team

doing improvement

hi everyone, i wanna do some improvement work on my template so feedback of all guyz important for me i not very good in html and css but i am trying to learn designing concept too Thanks Rockwood

Can you send me the PSD?

awesome Frosty and best of luck

Good Luck Cronus

few security issues are showing in your script

http://kuza55.blogspot.in/2006/03/request-variable-fixation.html

instead of asking ,you should read more about php

as per my knowledge please avoid $_REQUEST, i think it is not good for practice

<?php error_reporting(1); echo "<table width='100%'><tr><td valign='left' width='95%'><font size=2 color=silver><b>Weapon Market</b></font></td><td><table width=100%><tr><td align=right>"; include ('../beta/files/link.php'); echo " Weapon Market. Users can come here to buy weapons that they can to to another city and sell at a black market for profit.'></a></td></tr></table><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; if (!isset($tools)) { echo "<font color=red><b>Error | It Seems Something Went Wrong Processing Your Account. Please Try Logging Out And Then Logging Back In. If The Problem Persists Please Email Support At [email protected]. We Apologize For The Inconvenience.</b></font><center><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; session_destroy(); exit(); } $qry = 'SELECT * FROM weapons WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); $has_weapons_array = mysql_fetch_array($res); $weapon_names = array('bbgun_bullet', 'handgun_bullet', 'shotgun_bullet', 'rifle_bullet', 'bbgun', 'handgun', 'shotgun', 'ak47', 'bomb', 'taser', 'baseballbat', 'shank', 'detonator', 'battery'); $name_hash = array('bbgun_bullet' => 'BBGun Bullet (4-9)', 'handgun_bullet' => 'Handgun Bullet (9-47)', 'shotgun_bullet' => 'Shotgun Bullet (28,142)', 'rifle_bullet' => 'Rifle Bullet (47-237)', 'bbgun' => 'BBGun (280-300)', 'handgun' => 'Handgun (470-500)', 'shotgun' => 'Shotgun (96-100)', 'ak47' => 'AK47 (415-500)', 'bomb' => 'Bomb (248-250)', 'taser' => 'Taser (45-50)', 'baseballbat' => 'Baseball Bat (90-100)', 'shank' => 'Shank (55-100)', 'detonator' => 'Detonator (427-475)', 'battery' => 'Battery (3-9)'); $qry = 'SELECT * FROM prices_booze WHERE city=' . db_quote_smart($player->city); $res = db_query($qry); $prices = mysql_fetch_array($res); $qry = 'SELECT * FROM weapons WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); $weapons = mysql_fetch_array($res); $limit = $has_weapons_array["weapon_limit"]; $space_used = 0; foreach($weapon_names as $name) { $space_used+= $weapons[$name]; } $space_left = $limit - $space_used; $action = $_GVARS['action']; if ($action == 'buy') { foreach($weapon_names as $weapon) { $price = $prices[$weapon]; $amount = (isset($_POST[$weapon]) ? intval($_POST[$weapon]) : 0); $cost = $price * $amount; if ($amount > 0) { if ($gUser['cash'] < $cost) { echo "<font color=red><b>Error | You Do Not Have Enough Money To Purchase $amount unit(s) Of $weapon.</b></font><center><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; } elseif (($space_left - $amount) < 0) { echo "<font color=red><b>Error | You Do Not Have Enough Space To Carry $amount unit(s) Of $weapon.</b></font><center><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; } else { $space_left-= $amount; $gUser['cash']-= $cost; $qry = 'UPDATE user_characters SET cash=cash-' . $cost . ' WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); $randscam = mt_rand(1, 100); $randscam2 = mt_rand(1, 100); if ($randscam == $randscam2) { echo "<font color=red><b>Error | You Were Scammed By A Dealer. The Weapons You Bought Turned Out To Be Replicas.</b></font><center><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; $randexp = rand(0, 1); $qry = 'UPDATE user_characters SET exp=exp+' . $randexp . ' WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); } else { $qry = "UPDATE weapons SET $weapon=$weapon+$amount WHERE uid=" . db_quote_smart($player->uid); $res = db_query($qry); $randexp2 = rand(1, 3); $qry = " UPDATE user_characters SET exp= exp + " . $randexp2 . ', drug_points=drug_points+' . $amount . ' WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); $sql = "UPDATE adv_stats SET drugs_bought=drugs_bought+$amount WHERE email='" . $stats_array["email"] . "'"; $sql = mysql_query($sql); echo "<font color=green><b>Ciao | You Have Purchased $amount Crate(s) Of $weapon.</b></font><center><img src='/beta/layout_images/headertop.gif' width=100% height=4></center>"; } } } } } // gets updated version of weapons in pocket $qry = 'SELECT * FROM weapons WHERE uid=' . db_quote_smart($player->uid); $res = db_query($qry); $has_weapons_array = mysql_fetch_array($res); echo "<table align=center width=100% bgcolor=000000><tr><td>"; echo "<table width='450' cellpadding='0' border='2' bordercolor='black' style='margin:0 auto;background-image: url(/beta/layout_images/bg_2.gif);'> <tr bgcolor=#11111> <td align=center> <font face=verdana size=1 color=silver><b>Weapon</b></font> </td> <td align=center> <font face=verdana size=1 color=silver><b>Cost</b></font> </td> <td align=center> <font face=verdana size=1 color=silver><b># you have</b></font> </td> <td align=center> <font face=verdana size=1 color=silver><b># to buy</b></font> </td> </tr>"; $space_used = 0; $row = 0; foreach($weapon_names as $weapon) { $space_used+= $has_weapons_array[$weapon]; echo ('<tr bgcolor="#' . ($row++ % 2 ? '444444' : '333333') . '"> <td align="center" width="125"><font face="tahoma" size="1" color="#ffffff"><b><a href="javascript<img src="images/smilies/tongue.png" border="0" alt="" title="Stick Out Tongue" class="inlineimg" />opUp(\'weaponsmarket_graph_view.php?weapons=' . $weapon . '\')">' . $name_hash[$weapon] . '</a></b></td> <td align="center" width="125"><font face="tahoma" size="1" color="#ffffff">$ ' . number_format($prices[$weapon]) . '</font></td> <td align="center" width="125"><font face="tahoma" size="1" color="#ffffff">' . number_format($has_weapons_array[$weapon]) . '</font></td> <td align="center" width="125"><font face="tahoma" size="1" color="#ffffff"><form name="login" action="driver.php?x=weaponstore" method="post"><input type="text" name="' . $weapon . '" size=5 style="font-weight:none;font-size:8pt;color:#ffffff;font-family:arial;background-color:#000000;border-color:#ffffff" maxlength="15"></font></td> </tr>';} echo " </table> <table width='450' cellpadding='0' border='2' bordercolor='black' style='margin:0 auto;background-image: url(/beta/layout_images/bg_2.gif);'> <tr bgcolor=#11111 valign=top><td> <table width=100%><tr> <td align=left width=125><font face=verdana size=1 color=silver><input type=radio checked name=action value=buy> Buy </td> <td align=center width=250><font size=1><font color=#FFFFFF><b>Weapon space:</b></font> " . $space_used . "/" . $has_weapons_array["weapon_limit"] . "</font></td> <td align=right width=125><center><font face=verdana size=1 color=silver><input type=submit value=\" Purchase Weapon \" style=\"FONT-WEIGHT: bold; FONT-SIZE: 8pt; COLOR: #FFFFFF; FONT-FAMILY: Arial; BACKGROUND-COLOR: #333333\" size=1></center></td> </tr></table> </td></tr> </table>"; ?> friend try now

i can try for you right now

File Type: nwp player_rating.nwp (6.0 KB, 1 views) but it is not showing proper code to me (showing like" xÚíZ 8”í»¥ÂØ‘ô½&ËИ±gûš-Œ3¯1a†™±G$Ò*©ì¢BˆD)¡ì*!iETDêKŸTTÒyg¨Sß÷õ?ßùŸë:×u®Óåšå}žû¾Ÿ{ùÝÏ<·ç&è¨éÄ0tÔuTB0„Ôe訨é C‚Q݇N`R¨dÖ <O"0")