You don't check in the attack script if the NPC exits... This way if they put ?attack=1 behind the url they will just get $500 free each time. 
  
   $res = mysql_query("SELECT `hosp`,`strength`,`speed`,`defense`,`npc_name` FROM `npc_bots` WHERE `id` = ".$_GET['ID']);
   $numRows = mysql_num_rows($res);
   if($numRows > 0) {
   $row = mysql_fetch_array($res);
     /// Do attack here
   } else {
       echo Message("The NPC you are trying to attack does not exist.");
   }
  
Also, I don't see $_GET['ID'] being secured. 
  
$_GET['ID'] = abs((int)$_GET['ID']);
  
Other then that, Great job :)