You don't check in the attack script if the NPC exits... This way if they put ?attack=1 behind the url they will just get $500 free each time.
$res = mysql_query("SELECT `hosp`,`strength`,`speed`,`defense`,`npc_name` FROM `npc_bots` WHERE `id` = ".$_GET['ID']);
$numRows = mysql_num_rows($res);
if($numRows > 0) {
$row = mysql_fetch_array($res);
/// Do attack here
} else {
echo Message("The NPC you are trying to attack does not exist.");
}
Also, I don't see $_GET['ID'] being secured.
$_GET['ID'] = abs((int)$_GET['ID']);
Other then that, Great job :)