sullins38

Ok will do soon

As in securing the pages that need it

Wow thanks I really appreciate this! Would you be interested in doing the whole game for me ? If so what would u charge or recommend someone ?

What about this ?   <?php include "globals.php"; print "<h3>Item Market</h3>"; switch($_GET['action']) { case "buy": item_buy(); break; case "gift1": item_gift1(); break; case "gift2": item_gift2(); break; case "remove": itemm_remove(); break; default: imarket_index(); break; } function imarket_index() { global $var,$var2; $_GET['ID'] = abs(intval(($_GET['ID'])); $check = $db->query("SELECT im.*,i.* FROM itemmarket im LEFT JOIN items i ON im.imITEM=i.itmid WHERE imID={$_GET['ID']} AND imADDER=$userid"); } global $db,$ir,$c,$userid,$h; print "Viewing all listings... <table width=75% cellspacing=1 class='table'> <tr style='background:gray'> <th>Adder</th> <th>Item</th> <th>Price</th> <th>Links</th> </tr>"; $q=$db->query("SELECT im.*, i.*, u.*,it.* FROM itemmarket im LEFT JOIN items i ON im.imITEM=i.itmid LEFT JOIN users u ON u.userid=im.imADDER LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid ORDER BY i.itmtype, i.itmname ASC"); $lt=""; while($r=$db->fetch_row($q)) { if($lt!=$r['itmtypename']) { $lt=$r['itmtypename']; print "\n<tr style='background: gray;'><th colspan=4>{$lt}</th></tr>"; } if($r['imCURRENCY']=="money") { $price="\$".number_format($r['imPRICE']); } else { $price=number_format($r['imPRICE'])." crystals"; } if($r['imADDER'] == $userid) { $link = "[<a href='itemmarket.php?action=remove&ID={$r['imID']}'>Remove</a>]"; } else { $link = "[<a href='itemmarket.php?action=buy&ID={$r['imID']}'>Buy</a>] [<a href='itemmarket.php?action=gift1&ID={$r['imID']}'>Gift</a>]"; } print "\n<tr> <td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> [{$r['userid']}]</td> <td>{$r['itmname']}</td> <td>$price</td> <td>[<a href='iteminfo.php?ID={$r['itmid']}'>Info</a>] $link</td> </tr>"; } print "</table>"; } function itemm_remove() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT im.*,i.* FROM itemmarket im LEFT JOIN items i ON im.imITEM=i.itmid WHERE imID={$_GET['ID']} AND imADDER=$userid"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or you are not the owner.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); item_add($userid, $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID={$_GET['ID']}"); $db->query("INSERT INTO imremovelogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} removed a {$r['itmname']} from the item market.')"); print "Item removed from market!<br /> <a href='itemmarket.php'>> Back</a>"; } function item_buy() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID={$_GET['ID']}",$c); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } item_add($userid, $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID={$_GET['ID']}"); $db->query("UPDATE users SET $curr=$curr-{$r['imPRICE']} where userid=$userid"); $db->query("UPDATE users SET $curr=$curr+{$r['imPRICE']} where userid={$r['imADDER']}"); if($curr=="money") { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for \$".number_format($r['imPRICE']).".",$c); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for \${$r['imPRICE']} from user ID {$r['imADDER']}')"); print "You bought the {$r['itmname']} from the market for \$".number_format($r['imPRICE'])."."; } else { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for ".number_format($r['imPRICE'])." crystals.",$c); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for {$r['imPRICE']} crystals from user ID {$r['imADDER']}')"); print "You bought the {$r['itmname']} from the market for ".number_format($r['imPRICE'])." crystals."; } } function item_gift1() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID={$_GET['ID']}"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } if($curr=="money") { print "Buying the <b>{$r['itmname']}</b> for \$".number_format($r['imPRICE'])." as a gift...<br /> <form action='itemmarket.php?action=gift2' method='post'> <input type='hidden' name='ID' value='{$_GET['ID']}' /> User to give gift to: ".user_dropdown($c,'user')."<br /> <input type='submit' value='Buy Item and Send Gift' /></form>"; } else { print "Buying the <b>{$r['itmname']}</b> for ".number_format($r['imPRICE'])." crystals as a gift...<br /> <form action='itemmarket.php?action=gift2' method='post'> <input type='hidden' name='ID' value='{$_GET['ID']}' /> User to give gift to: ".user_dropdown($c,'user')."<br /> <input type='submit' value='Buy Item and Send Gift' /></form>"; } } $usercheck = $db->query("SELECT `userid` FROM `users` WHERE `userid` = ".$_POST['userid']); // Preform check using num_rows() if(!$db->num_rows($usercheck)) { // error $h->endpage(); exit; } function item_gift2() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID={$_POST['ID']}"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } item_add($_POST['user'], $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID={$_POST['ID']}"); $db->query("UPDATE users SET $curr=$curr-{$r['imPRICE']} where userid=$userid"); $db->query("UPDATE users SET $curr=$curr+{$r['imPRICE']} where userid={$r['imADDER']}"); if($curr=="money") { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for \$".number_format($r['imPRICE']).".",$c); event_add($_POST['user'], "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought you a {$r['itmname']} from the item market as a gift.",$c); $u=$db->query("SELECT username FROM users WHERE userid={$_POST['user']}"); $uname=$db->fetch_single($u); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for \${$r['imPRICE']} from user ID {$r['imADDER']} as a gift for $uname [{$_POST['user']}]')"); print "You bought the {$r['itmname']} from the market for \$".number_format($r['imPRICE'])." and sent the gift to $uname."; } else { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for ".number_format($r['imPRICE'])." crystals.",$c); event_add($_POST['user'], "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought you a {$r['itmname']} from the item market as a gift.",$c); $u=$db->query("SELECT username FROM users WHERE userid={$_POST['user']}"); $uname=$db->fetch_single($u); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for {$r['imPRICE']} crystals from user ID {$r['imADDER']} as a gift for $uname [{$_POST['user']}]')"); print "You bought the {$r['itmname']} from the market for ".number_format($r['imPRICE'])." crystals and sent the gift to $uname."; } } $h->endpage(); ?>

look correct anything i missed ?     <?php include "globals.php"; print "<h3>Item Market</h3>"; switch($_GET['action']) { case "buy": item_buy(); break; case "gift1": item_gift1(); break; case "gift2": item_gift2(); break; case "remove": itemm_remove(); break; default: imarket_index(); break; } function imarket_index() { global $db,$ir,$c,$userid,$h; print "Viewing all listings... <table width=75% cellspacing=1 class='table'> <tr style='background:gray'> <th>Adder</th> <th>Item</th> <th>Price</th> <th>Links</th> </tr>"; $q=$db->query("SELECT im.*, i.*, u.*,it.* FROM itemmarket im LEFT JOIN items i ON im.imITEM=i.itmid LEFT JOIN users u ON u.userid=im.imADDER LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid ORDER BY i.itmtype, i.itmname ASC"); $lt=""; while($r=$db->fetch_row($q)) { if($lt!=$r['itmtypename']) { $lt=$r['itmtypename']; print "\n<tr style='background: gray;'><th colspan=4>{$lt}</th></tr>"; } if($r['imCURRENCY']=="money") { $price="\$".number_format($r['imPRICE']); } else { $price=number_format($r['imPRICE'])." crystals"; } if($r['imADDER'] == $userid) { $link = "[<a href='itemmarket.php?action=remove&ID={$r['imID']}'>Remove</a>]"; } else { $link = "[<a href='itemmarket.php?action=buy&ID={$r['imID']}'>Buy</a>] [<a href='itemmarket.php?action=gift1&ID={$r['imID']}'>Gift</a>]"; } print "\n<tr> <td><a href='viewuser.php?u={$r['userid']}'>{$r['username']}</a> [{$r['userid']}]</td> <td>{$r['itmname']}</td> <td>$price</td> <td>[<a href='iteminfo.php?ID={$r['itmid']}'>Info</a>] $link</td> </tr>"; } print "</table>"; } function itemm_remove() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT im.*,i.* FROM itemmarket im LEFT JOIN items i ON im.imITEM=i.itmid WHERE imID=$_GET[‘ID’] = abs((int) $_GET[‘ID’]) AND imADDER=$userid"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or you are not the owner.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); item_add($userid, $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID=$_GET[‘ID’] = abs((int) $_GET[‘ID’])"); $db->query("INSERT INTO imremovelogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} removed a {$r['itmname']} from the item market.')"); print "Item removed from market!<br /> <a href='itemmarket.php'>> Back</a>"; } function item_buy() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID=$_GET[‘ID’] = abs((int) $_GET[‘ID’])",$c); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } item_add($userid, $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID=$_GET[‘ID’] = abs((int) $_GET[‘ID’])"); $db->query("UPDATE users SET $curr=$curr-{$r['imPRICE']} where userid=$userid"); $db->query("UPDATE users SET $curr=$curr+{$r['imPRICE']} where userid={$r['imADDER']}"); if($curr=="money") { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for \$".number_format($r['imPRICE']).".",$c); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for \${$r['imPRICE']} from user ID {$r['imADDER']}')"); print "You bought the {$r['itmname']} from the market for \$".number_format($r['imPRICE'])."."; } else { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for ".number_format($r['imPRICE'])." crystals.",$c); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for {$r['imPRICE']} crystals from user ID {$r['imADDER']}')"); print "You bought the {$r['itmname']} from the market for ".number_format($r['imPRICE'])." crystals."; } } function item_gift1() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID=$_GET[‘ID’] = abs((int) $_GET[‘ID’])"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } if($curr=="money") { print "Buying the <b>{$r['itmname']}</b> for \$".number_format($r['imPRICE'])." as a gift...<br /> <form action='itemmarket.php?action=gift2' method='post'> <input type='hidden' name='ID' value='$_GET[‘ID’] = abs((int) $_GET[‘ID’])' /> User to give gift to: ".user_dropdown($c,'user')."<br /> <input type='submit' value='Buy Item and Send Gift' /></form>"; } else { print "Buying the <b>{$r['itmname']}</b> for ".number_format($r['imPRICE'])." crystals as a gift...<br /> <form action='itemmarket.php?action=gift2' method='post'> <input type='hidden' name='ID' value='{$_GET[‘ID’] = abs((int) $_GET[‘ID’])' /> User to give gift to: ".user_dropdown($c,'user')."<br /> <input type='submit' value='Buy Item and Send Gift' /></form>"; } } function item_gift2() { global $db,$ir,$c,$userid,$h; $q=$db->query("SELECT * FROM itemmarket im LEFT JOIN items i ON i.itmid=im.imITEM WHERE imID=$_POST[‘ID’] = abs((int) $_POST[‘ID’])"); if(!$db->num_rows($q)) { print "Error, either this item does not exist, or it has already been bought.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } $r=$db->fetch_row($q); $curr=$r['imCURRENCY']; if($r['imPRICE'] > $ir[$curr]) { print "Error, you do not have the funds to buy this item.<br /> <a href='itemmarket.php'>> Back</a>"; $h->endpage(); exit; } item_add($_POST['user'], $r['imITEM'], 1); $i=($db->insert_id()) ? $db->insert_id() : 99999; $db->query("DELETE FROM itemmarket WHERE imID=$_POST[‘ID’] = abs((int) $_POST[‘ID’])"); $db->query("UPDATE users SET $curr=$curr-{$r['imPRICE']} where userid=$userid"); $db->query("UPDATE users SET $curr=$curr+{$r['imPRICE']} where userid={$r['imADDER']}"); if($curr=="money") { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for \$".number_format($r['imPRICE']).".",$c); event_add($_POST['user'], "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought you a {$r['itmname']} from the item market as a gift.",$c); $u=$db->query("SELECT username FROM users WHERE userid={$_POST['user']}"); $uname=$db->fetch_single($u); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for \${$r['imPRICE']} from user ID {$r['imADDER']} as a gift for $uname [{$_POST['user']}]')"); print "You bought the {$r['itmname']} from the market for \$".number_format($r['imPRICE'])." and sent the gift to $uname."; } else { event_add($r['imADDER'],"<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought your {$r['itmname']} item from the market for ".number_format($r['imPRICE'])." crystals.",$c); event_add($_POST['user'], "<a href='viewuser.php?u=$userid'>{$ir['username']}</a> bought you a {$r['itmname']} from the item market as a gift.",$c); $u=$db->query("SELECT username FROM users WHERE userid={$_POST['user']}"); $uname=$db->fetch_single($u); $db->query("INSERT INTO imbuylogs VALUES ('', {$r['imITEM']}, {$r['imADDER']}, $userid, {$r['imPRICE']}, {$r['imID']}, $i, unix_timestamp(), '{$ir['username']} bought a {$r['itmname']} from the item market for {$r['imPRICE']} crystals from user ID {$r['imADDER']} as a gift for $uname [{$_POST['user']}]')"); print "You bought the {$r['itmname']} from the market for ".number_format($r['imPRICE'])." crystals and sent the gift to $uname."; } } $h->endpage(); ?>

Something along these lines ?   $_GET[‘ID’] = abs((int) $_GET[‘ID’]);

ok im gonna look into this more later on maybe i could get an example

How would i go about getting this secured once i got everything done ?

Thnaks for the advice im new to all of this

Awesome thank you guys for the help!

Im getting the blank page

now im getting this Notice: Undefined index: spend in /home/.../public_html/crystaltemple.php on line 4

i found the error now it works thank you soo much  

It still does the same thing i fought with it for hours last night

Im trying to set this up where it will refill your brave just like energy but i just cant get it to work everytime i try the page turns white any pointers tips or help would be greatly apprciated ive already got the db queries set up i just need help with the top part <?php include "globals.php"; if(!$_GET['spend']) { print "Welcome to the crystal temple!<br /> You have <b>{$ir['crystals']}</b> crystals.<br /> What would you like to spend your crystals on?<br /> <br /> <a href='crystaltemple.php?spend=refill'>Energy Refill - {$set['ct_refillprice']} Crystals</a><br /> <a href='crystaltemple.php?spend=IQ'>IQ - {$set['ct_iqpercrys']} IQ per crystal</a><br /> <a href='crystaltemple.php?spend=money'>Money - \$".number_format($set['ct_moneypercrys'])." per crystal</a><br />"; } else { if($_GET['spend'] == 'brefill') } if($ir['crystals'] <$set['br_refillprice']) { print "You don't have enough crystals!"; } else if($ir['brave'] == $ir['maxbrave']) { print "You already have full energy."; } else { if($_GET['spend'] == 'refill') { if($ir['crystals'] <$set['ct_refillprice']) { print "You don't have enough crystals!"; } else if($ir['energy'] == $ir['maxenergy']) { print "You already have full energy."; } else { $db->query("UPDATE users SET energy=maxenergy,crystals=crystals-{$set['ct_refillprice']} WHERE userid=$userid"); print "You have paid {$set['ct_refillprice']} crystals to refill your energy bar."; } } else if($_GET['spend'] == 'IQ') { print "Type in the amount of crystals you want to swap for IQ.<br /> You have <b>{$ir['crystals']}</b> crystals.<br /> One crystal = {$set['ct_iqpercrys']} IQ.<form action='crystaltemple.php?spend=IQ2' method='post'><input type='text' name='crystals' /><br /><input type='submit' value='Swap' /></form>"; } else if($_GET['spend'] == 'IQ2') { $_POST['crystals']=(int) $_POST['crystals']; if($_POST['crystals'] <= 0 || $_POST['crystals'] > $ir['crystals']) { print "Error, you either do not have enough crystals or did not fill out the form.<br /> <a href='crystaltemple.php?spend=IQ'>Back</a>"; } else { $iqgain=$_POST['crystals']*$set['ct_iqpercrys']; $db->query("UPDATE users SET crystals=crystals-{$_POST['crystals']} WHERE userid=$userid"); $db->query("UPDATE userstats SET IQ=IQ+$iqgain WHERE userid=$userid"); print "You traded {$_POST['crystals']} crystals for $iqgain IQ."; } } else if($_GET['spend'] == 'money') { print "Type in the amount of crystals you want to swap for money.<br /> You have <b>{$ir['crystals']}</b> crystals.<br /> One crystal = \$".number_format($set['ct_moneypercrys']).".<form action='crystaltemple.php?spend=money2' method='post'><input type='text' name='crystals' /><br /><input type='submit' value='Swap' /></form>"; } else if($_GET['spend'] == 'money2') { $_POST['crystals']=(int) $_POST['crystals']; if($_POST['crystals'] <= 0 || $_POST['crystals'] > $ir['crystals']) { print "Error, you either do not have enough crystals or did not fill out the form.<br /> <a href='crystaltemple.php?spend=money'>Back</a>"; } else { $iqgain=$_POST['crystals']*$set['ct_moneypercrys']; $db->query("UPDATE users SET crystals=crystals-{$_POST['crystals']},money=money+$iqgain WHERE userid=$userid"); print "You traded {$_POST['crystals']} crystals for \$".number_format($iqgain)."."; } } } ini_set('display_errors',1); error_reporting(E_ALL); $h->endpage(); ?>