Hi Everyone, i have this mod that i found in one of the forums, after making it work in my game, one thing i noticed that i can remove Bets made my other players. I'm not coder myself, however if someone can look at the code and let me know how to secure it so that If i place a bet, another player cannot cancel by just pasting the Code into URL with the Game ID in it. (I tried and it seems that any player can cancel any ones bet)
Any help or advice would be great. Thank you.
<?php
session_start();
require "global_func.php";
if ($_SESSION['loggedin'] == 0) {
header("Location: login.php");
exit;
}
$userid = $_SESSION['userid'];
require "header.php";
$h = new headers;
$h->startheaders();
include "mysql.php";
global $c;
$is = mysql_query("SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid", $c) or die(mysql_error());
$ir = mysql_fetch_array($is);
check_level();
$fm = money_formatter($ir['money']);
$cm = money_formatter($ir['crystals'], '');
$lv = date('F j, Y, g:i a', $ir['laston']);
$h->userdata($ir, $lv, $fm, $cm);
$h->menuarea();
$minbet=1;
$maxg=5;
echo "<big>50 / 50 For Money Game</big>
";
print "Please note 10% Bookie fee is taken for winnings, however your money gets depoisted directly to the bank
" ;
function add_game()
{
global $ir,$c,$userid, $db, $minbet, $maxg;
if(!isset($_POST['amt']))
{
echo "<big>Adding a game</big>
<form action='chance.php?add=1' method='post'>
Amount $<input type='text' name='amt' size=10 maxlength=10>
<input type='submit' value='Add!'></form>
($maxg games max per user)
[url='chance.php']Back[/url]";
}
else
{
$_POST['amt'] = abs((int) $_POST['amt']);
if($_POST['amt'] < $minbet){echo "The minimum bet is $minbet
[url='chance.php?add=1']Back[/url]";exit;}
$checkcount=query("SELECT logID FROM chance WHERE userID={$ir['userid']} and active=1");
if(mysql_num_rows($checkcount) > ($maxg-1)){echo "There is a maximum of $maxg games per user.
[url='chance.php']Back[/url]";exit;}
if($ir['money'] < $_POST['amt']){echo "You cannot afford that amount.
[url='chance.php']Back[/url]";exit;}
query("UPDATE users SET money = money - {$_POST['amt']} WHERE userid = {$ir['userid']}");
$ir['money']=$ir['money'] - $_POST['amt'];
query("INSERT INTO chance VALUES ('', {$ir['userid']}, {$_POST['amt']}, 1)");
echo "Your game has been set. Good Luck.
[url='chance.php']Back[/url]";
}
}
function view_games()
{
global $ir,$c,$userid, $db, $maxg;
$q=query("SELECT c.*, u.username FROM chance c left join users u on u.userid = c.userID WHERE c.active = 1 ORDER BY c.logID ASC");
echo "[url='chance.php?add=1']Add Game[/url]
Table of users awaiting a challenge
<table class='table' width=50%><tr><th>Player</th><th>Cost</th><th>Prize</th><th>Challenge</th><th>Cancel</th></tr>";
if(mysql_num_rows($q) < 1){echo "<tr><td colspan=5>There are currenly no challenges</td></tr>";}
while($r=mysql_fetch_array($q))
{
echo "<tr><td align='center'>[url='viewuser.php?u={$r[']{$r['username']}[/url] [{$r['userID']}]</td><td align='right'>".money_formatter($r['amount'])."</td><td align='right'>".money_formatter((($r['amount'])* 2) * 0.90)."</td><td align='center'>[url='chance.php?chal={$r[']Challenge[/url]</td><td align='center'>";
if($ir['userid']==$r['userID']){echo "[url='chance.php?cancel={$r[']Cancel[/url]";}
echo "</td></tr>";
}
echo "</table>";
}
function dogame()
{
global $ir,$c,$userid, $db;
$_GET['chal'] = abs((int) $_GET['chal']);
$q=query("SELECT c.*, u.username from chance c LEFT JOIN users u ON c.userID = u.userid Where c.logID={$_GET['chal']} AND c.active = 1 LIMIT 1");
if(mysql_num_rows($q) > 0)
{
$r=mysql_fetch_array($q);
if($ir['money'] < $r['amount']){echo "You cannot afford the challenge amount.
[url='chance.php']Back[/url]";exit;}
if($ir['userid'] == $r['userID']){echo "You cannot accept your own challenge.
[url='chance.php']Back[/url]";exit;}
if(rand(1,2) == 1)
{
$winner=$r['userID']; $loser=$ir['userid'];
$winnername=$r['username'];
$losername=$ir['username'];
$tstring="Sorry, you Lost. Better luck next time.
[url='chance.php']Back[/url]";
query("UPDATE users SET money = money - {$r['amount']} WHERE userid={$ir['userid']}");
query("UPDATE users SET bankmoney=bankmoney + (({$r['amount']} * 2) * 0.90) WHERE userid={$r['userID']}");
}
else
{
$winner=$ir['userid']; $loser=$r['userID'];
$winnername=$ir['username'];
$losername=$r['username'];
$tstring="You Won! 50/50 and you have collected ".money_formatter(($r['amount'])* 0.90)."
[url='chance.php']Back[/url]";
query("UPDATE users SET bankmoney=bankmoney + ({$r['amount']} * 0.90) WHERE userid={$ir['userid']}");
}
event_add($winner, "You Won ".money_formatter(($r['amount']) * 0.90)." 50/50 game challenged by [url='viewuser.php?u={$r[']{$r['username']}[/url] was won by [url='viewuser.php?u={$winner}']{$winnername}[/url].", $c);
event_add($loser, "You Lost ".money_formatter($r['amount'])." 50/50 game challenged by [url='viewuser.php?u={$r[']{$r['username']}[/url] was won by [url='viewuser.php?u={$winner}']{$winnername}[/url].", $c);
query("UPDATE chance SET active = 0 WHERE logID={$_GET['chal']}");
echo $tstring;
}
else
{
echo "This game has either been cancelled or someone played before you got the chance.
[url='chance.php']Back[/url]"; exit;
}
}
function cancel()
{
global $ir,$c,$userid, $db;
$_GET['cancel'] = abs((int) $_GET['cancel']);
$q=query("SELECT * from chance where logID={$_GET['cancel']} AND active = 1");
if(mysql_num_rows($q) > 0)
{
$r=mysql_fetch_array($q);
query("UPDATE users SET money = money + {$r['amount']} WHERE userid = {$ir['userid']}");
$ir['money']=$ir['money'] + $r['amount'];
query("UPDATE chance SET active = -1 WHERE logID = {$_GET['cancel']}");
echo "The game has been cancelled, and your money has been returned.
[url='chance.php']Back[/url]";
}
else
{
echo "This game has already been canceled, does not exist, or someone already played.
[url='chance.php']Back[/url]";
}
}
if(isset($_GET['cancel'])){cancel();}
elseif(isset($_GET['chal'])){dogame();}
elseif(isset($_GET['add'])){add_game();}
else{view_games();}
?>