Ok so I finally figured this out. It was so simple I really can't believe I didn't see it sooner. I didn't use a session because I truly just can't understand how they work. It was the attack page that really set me in the right direction.
First step is to add a row to you user table in the data base. For our needs we are going to call it "streeting" (yeah I know thats not a word, but it work.) Make sure you set the default to 0.
Next we need a bit of code in your header.
if ($atkpage == 0 && $ir['streeting']==1){
$db->query("UPDATE users SET attacking=0, streeting=0 WHERE userid=$userid");
}
This is going to make sure that if you are not on the attack page everything is set to zero.
Next is my streets page. I added this bit of code in the same block as the code that would send you to fight the NPC. It sets streeting to one.
else if($step['reward_type'] == 'npc'){
$db->query("UPDATE users SET streeting=1 WHERE userid=$userid");
$q=$db->query("SELECT cb.*,u.* FROM challengebots cb LEFT JOIN users u ON cb.cb_npcid=u.userid LEFT JOIN cities cy ON u.location=cy.cityid WHERE u.level <= {$ir['level']} ORDER BY u.level desc LIMIT 1");
$s=$db->fetch_row($q);
print"While out walking the streets you run into {$s['username']}, they seem to be looking for a fight.<br />
<a href='attack.php?ID={$s['userid']}'>Fight them?</a><br/>";
}
Just a couple of more bits of code in all the attack results files i.e. 'attackwon, attackloss, attackbeat, attacktake'. This makes sure that streeting is set back to zero after an attack. Its placed just in the top of the file.
$db->query("UPDATE users SET attacking=0, streeting=0 WHERE userid=$userid");
And the final piece of code is in the attack.php itself.
if ($ir['streeting'] == 0 && $r['user_level'] == 0)
{
die ("Cheaters don't get anywhere.");
}
You have to make sure and add the && $r['user_level'] == 0 or else you will not be able to attack any other player at all.
That does it. The part in the header makes sure that if you change the URL to another page while in an attack on an NPC that streeting is set back to zero anyways. So there is no back out and trying again. Although that would be pointless in the first place as attacking the NPC is the goal. Still I feel it is better to leave no holes.