Secure 5050 Mod please. Code posted here

[VitalEnd]

Hey all, just posting a 5050 mod up here, this is for crystals althoguh in my game i use poitns so i have the field changed. I would appreciate a little security here as i know you are able to remove a bet even if you are not the poster of that bet. Here is the code:

 

<?php
include "globals.php";

$minbet=1;
$maxg=10;

echo "<big>[b]50/50 Points[/b]</big>

";

function add_game()
{

global $ir,$t,$userid, $db, $minbet, $maxg;

if(!isset($_POST['amt']))
{
	echo "<big>Adding a game</big>


		<form action='5050_points.php?add=1' method='post'>
		Amount of Points:<input type='text' name='amt' size=10 maxlength=10>


<input type='submit' value='Add!'></form>
($maxg games max per user)

[url='5050_points.php']Back[/url]";

}
else
{
	$_POST['amt'] = abs((int) $_POST['amt']); 
	if($_POST['amt'] < $minbet){echo "The minimum bet is $minbet

[url='5050_points.php?add=1']Back[/url]";exit;}

	$theckcount=$db->query("SELECT logID FROM 5050_points WHERE userID={$ir['userid']} and active=1");
	if($db->num_rows($theckcount) > ($maxg-1)){echo "There is a maximum of $maxg games per user.

[url='5050_points.php']Back[/url]";exit;}

	if($ir['points'] < $_POST['amt']){echo "You cannot afford that amount.

[url='5050_points.php']Back[/url]";exit;}

	$db->query("UPDATE users SET points = points - {$_POST['amt']} WHERE userid = {$ir['userid']}");
	$ir['points']=$ir['points'] - $_POST['amt'];

	$db->query("INSERT INTO 5050_points VALUES ('', {$ir['userid']}, {$_POST['amt']}, 1)");
	echo "Your game has been set.  Good Luck.

[url='5050_points.php']Back[/url]";
}

}

function view_games()
{
global $ir,$t,$userid, $db, $maxg;

$q=$db->query("SELECT t.*, u.username FROM 5050_points t left join users u on u.userid = t.userID WHERE t.active = 1 ORDER BY t.logID ASC");

echo "[url='5050_points.php?add=1']Add Game[/url]

Table of users awaiting a challenge

<table class='table' width=100%><tr><th>Game ID</th><th>User</th><th>Amount</th><th>Challenge</th><th>Cancel</th></tr>";
if($db->num_rows($q) < 1){echo "<tr><td colspan=5>There are currenly no challenges</td></tr>";}
while($r=$db->fetch_row($q))
{
	echo "<tr><td align=center>{$r['logID']}</td><td align=center>[url='viewuser.php?u={$r[']{$r['username']}[/url] [{$r['userID']}]</td><td align=center>{$r['amount']}</td><td align=center>[url='5050_points.php?chal={$r[']Challenge[/url]</td><td>";
	if($ir['userid']==$r['userID']){echo "[url='5050_points.php?cancel={$r[']Cancel[/url]";}				
	echo "</td></tr>";
}
echo "</table>";

}

function dogame()
{
global $ir,$t,$userid, $db;

$_GET['chal'] = abs((int) $_GET['chal']);
$q=$db->query("SELECT t.*, u.username from 5050_points t LEFT JOIN users u ON t.userID = u.userid Where t.logID={$_GET['chal']} AND t.active = 1 LIMIT 1");
if($db->num_rows($q) > 0)
{
	$r=$db->fetch_row($q);

	if($ir['points'] < $r['amount']){echo "You cannot afford the challenge amount.

[url='5050_points.php']Back[/url]";exit;}
	if($ir['userid'] == $r['userID']){echo "You cannot accept your own challenge.

[url='5050_points.php']Back[/url]";exit;}

	if(rand(1,2) == 1)
	{
		$winner=$r['userID']; $loser=$ir['userid'];
		$winnername=$r['username'];
		$losername=$ir['username'];
		$tstring="Sorry, you Lost. Better luck next time.

[url='5050_points.php']Back[/url]";
		$db->query("UPDATE users SET points = points - {$r['amount']} WHERE userid={$ir['userid']}");
		$db->query("UPDATE users SET points = points + ({$r['amount']} * 2) WHERE userid={$r['userID']}");
	}
	else
	{
		$winner=$ir['userid']; $loser=$r['userID'];
		$winnername=$ir['username'];
		$losername=$r['username'];
		$tstring="You Won! Congratulations! You Won {$r['amount']} points. 

[url='5050_points.php']Back[/url]";
		$db->query("UPDATE users SET points = points + {$r['amount']} WHERE userid={$ir['userid']}");
	}

	event_add($winner, "The game of {$r['amount']} points challenged by [url='viewuser.php?u={$r[']{$r['username']}[/url] was won by [url='viewuser.php?u={$winner}']{$winnername}[/url].", $t);
	event_add($loser, "The game of {$r['amount']} points challenged by [url='viewuser.php?u={$r[']{$r['username']}[/url] was won by [url='viewuser.php?u={$winner}']{$winnername}[/url].", $t);
	$db->query("UPDATE 5050_points SET active = 0 WHERE logID={$_GET['chal']}");

	echo $tstring;
}
else
{
	echo "This game has either been cancelled or someone played before you got the 5050.

[url='5050_points.php']Back[/url]"; exit;
}
}


function cancel()
{
global $ir,$t,$userid, $db;

$_GET['cancel'] = abs((int) $_GET['cancel']);
$q=$db->query("SELECT * from 5050_points where logID={$_GET['cancel']} AND active = 1");
if($db->num_rows($q) > 0)
{
	$r=$db->fetch_row($q);
	$db->query("UPDATE users SET points = points + {$r['amount']} WHERE userid = {$ir['userid']}");
	$ir['points']=$ir['points'] + $r['amount'];
	$db->query("UPDATE 5050_points SET active = -1 WHERE logID = {$_GET['cancel']}");

	echo "The game has been cancelled, and your points has been returned.

[url='5050_points.php']Back[/url]";
}
else
{
	echo "This game has already been canceled, does not exist, or someone already played.

[url='5050_points.php']Back[/url]";
}

}

if(isset($_GET['cancel'])){cancel();}
elseif(isset($_GET['chal'])){dogame();}
elseif(isset($_GET['add'])){add_game();}
else{view_games();}

?>