is my pointsmarket bug free

[grant]

if not can you please mail me wots needs to be fixed thanks

 

 

<?php
include 'header.php';
$_POST['amount'] = abs((int) $_POST['amount']);
if ($_POST['addpoints']){	
if($_POST['amount'] == 0){
	echo Message("Please enter a valid amount of money");
include 'footer.php';
die();
}


$_POST['amount'] = abs((int) $_POST['amount']);
	if($_POST['amount'] > $user_class->points){
	echo Message("You don't have that many points.");
}
if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['amount'])){
 echo Message("Please enter a valid amount");
 include "footer.php";
 die();
}
if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['price'])){
 echo Message("Please enter a valid amount");
 include "footer.php";
 die();
}
$time = time();
if($_POST['amount'] >= 1 && $_POST['amount'] <= $user_class->points && $_POST['price'] >= 1){
	echo Message("You have added ".$_POST['amount']." points to the market a price of $".$_POST['price']." per point.");
	$result= mysql_query("INSERT INTO `pointsmarket` (owner, amount, price )"."VALUES ('$user_class->id', '$_POST[amount]', '$_POST[price]')");
	$newpoints = $user_class->points - $_POST['amount'];
	$result = mysql_query("UPDATE `grpgusers` SET `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
	$user_class = new User($_SESSION['id']);
}
}
if ($_POST['buypoints']){

$result = mysql_query("SELECT * FROM `pointsmarket` WHERE `id`='".$_POST['points_id']."'");
$worked = mysql_fetch_array($result);
$price = $worked['price'];
$amount = $worked['amount'];
$totalcost = $price * $_POST['amount'];
$newpointsinmarket = $amount - $_POST['amount'];
$user_points = new User($worked['owner']);

if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['amount'])){
 echo Message("Please enter a valid amount");
 include "footer.php";
 die();
}

if($_POST['amount'] > $amount & $amount < 1){
	echo Message("They are not selling that many points.");
}
    	elseif($_POST['amount'] < 1){
	echo Message("Please enter a valid amount of points to buy.");
}
    	elseif($user_class->level < 5){
	echo Message("You must be at least level 5 to sell points on the market [<a href='pointmarket.php'>Back</a>].");
include 'footer.php';
die();
}
elseif ($totalcost > $user_class->money){
	echo Message("You don't have enough money.");
}
else {
	echo Message("You have bought ".$_POST['amount']." points for $".$totalcost);
	Send_Event($user_points->id, $user_class->username." bought ".$_POST['amount']." points for $".$totalcost);
	$newpoints = $user_class->points + $_POST['amount'];
	$newmoney = $user_class->money - $totalcost;
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."', `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
	$newmoney = $user_points->money + $totalcost;
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$user_points->id."'");
	$user_class = new User($_SESSION['id']);
		if ($newpointsinmarket == 0){
			$result = mysql_query("DELETE FROM `pointsmarket` WHERE `id`='".$worked['id']."'");
		} else {
			$result = mysql_query("UPDATE `pointsmarket` SET `amount` = '".$newpointsinmarket."' WHERE `id`='".$worked['id']."'");
		}
}
}
if ($_POST['remove']){
$result = mysql_query("SELECT * FROM `pointsmarket` WHERE `id`='".$_POST['points_id']."'");
   $worked = mysql_fetch_array($result);
   $price = $worked['price'];
   $amount = $worked['amount'];
	$totalcost = $price * $_POST['amount'];
	$newpointsinmarket = $amount - $_POST['amount'];
	$user_points = new User($worked['owner']);

if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['amount'])){
 echo Message("You dont have that many points");
 include "footer.php";
 die();
}


echo Message("You have taken ".$_POST['amount']." points off the market [<a href='pointmarket.php'>Back</a>].");
	$newpoints = $user_class->points + $_POST['amount'];;
	$result = mysql_query("UPDATE `grpgusers` SET `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");
	$user_class = new User($_SESSION['id']);
		if ($newpointsinmarket == 0){
			$result = mysql_query("DELETE FROM `pointsmarket` WHERE `id`='".$worked['id']."'");
		} else {
			$result = mysql_query("UPDATE `pointsmarket` SET `amount` = '".$newpointsinmarket."' WHERE `id`='".$worked['id']."'");
	}
include 'footer.php';
die();
}
?>
<link href="warrior.css" rel="stylesheet" type="text/css">

<tr><td class="contenthead">Point Market</td></tr>
<tr><td class="contentcontent">
Use this form to add points to the points market.<br><br>
<form method='post'>
<table align="center">
<tr>
<td>Amount of points</td><td>  <input name='amount' type='text' class="areatest" value='<? echo $user_class->points ?>' size='10' maxlength='20'></td>
</tr>
<tr>
<td>Price per point</td><td>$<input name='price' type='text' class="areatest" size='10' maxlength='20'></td>
<tr><td align="center" colspan="2"><input name='addpoints' type='submit' class="buttong" value='Add Points'></form></td>
</tr></table>
</td></tr>
<tr><td class="contentcontent">
<?php
$result = mysql_query("SELECT * FROM `pointsmarket` ORDER BY `price` DESC");
while($line = mysql_fetch_array($result, MYSQL_ASSOC)) {
$user_points = new User($line['owner']);
if ($user_points->id == $user_class->id){
	$submittext = "<input type='hidden' name='points_id'  value='".$line['id']."'><input type='submit' name='remove' class='buttong' value='Remove points'></form>";
} else {
	$submittext = "<input type='hidden' name='points_id'  value='".$line['id']."'><input type='submit' name='buypoints' class='buttong' value='Buy Points'></form>";
}
echo "<form method='post'>";
echo $user_points->formattedname." - ".$line['amount']." points for $".$line['price']." per point <input type='text' name='amount' size='3' class='areatest' maxlength='20' value='".$line['amount']."'> ".$submittext."</form><br>";
}
?>
</td></tr>
<?php
include 'footer.php';
?>

Edited July 11, 2011 by grant

[Rory_M]

For a start please you [*PHP*] [/*PHP*] tags (without the stars).

[Danny696]

Put it in your game and find out..

[Kieran-R]

Why are you asking us?

Go check if it bug free yourself... -_-

[grant]

for this website help you if you not sure ???? that y am posting it here

[Diesl]

However, this isn't a place where we do the work for you.

Run some test cases and debug it for yourself. If you should get any errors that you don't understand, then come back and post them and we can help you out. You'll become a much better developer if you take initiative instead of being lazy.

[Dominion]

Strange post... but no it's not bug free. I see a few undefined errors that could pop up, and well I have not spent more then about a minute looking, I do not see where a few of your $_POST's are secured.

[grant]

Strange post... but no it's not bug free. I see a few undefined errors that could pop up, and well I have not spent more then about a minute looking, I do not see where a few of your $_POST's are secured.

ok thanks Dominion

[grant]

However, this isn't a place where we do the work for you.

Run some test cases and debug it for yourself. If you should get any errors that you don't understand, then come back and post them and we can help you out. You'll become a much better developer if you take initiative instead of being lazy.

this website for helping other with they website if not then why is there a GRPG Support and i never ask for work to be done only asking if its bug free

[ShadyCoco]

Okay - It works.

It's not secure however...

Removing points can give people unlimited ammount of points.

[Xanthia]

$_POST['amount'] = abs((int) $_POST['amount']);

Check the type first, don't assume it is a string

 

$_POST['amount'] = abs((int) $_POST['amount']);

Why are you doing this again?

 

if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['amount'])){

I imagine that you really only want digits. BTW `-` if used in a character class should be at the end

 

if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['price'])){

Again, why are you permitting characters?

 

if($_POST['amount'] >= 1 && $_POST['amount'] <= $user_class->points && $_POST['price'] >= 1){

Use braces, or split into multiple lines for legability

 

$result= mysql_query("INSERT INTO `pointsmarket` (owner, amount, price )"."VALUES ('$user_class->id', '$_POST[amount]', '$_POST[price]')");

Check the result, don't ignore it

 

$result = mysql_query("UPDATE `grpgusers` SET `points` = '".$newpoints."' WHERE `id`='".$user_class->id."'");

Again, check the result

 

$user_class = new User($_SESSION['id']);

Say what now?

 

$result = mysql_query("SELECT * FROM `pointsmarket` WHERE `id`='".$_POST['points_id']."'");

Zing, injection point

 

I gave up after this. More holes than a Glaswegian slapper's stockings after a hard Saturday night on the town.

[Danny696]

$_POST['amount'] = abs((int) $_POST['amount']);

Check the type first, don't assume it is a string

There checking its a number, why you talking about strings? So thats fine. ;)

 

if (!preg_match("/^[-_a-zA-Z0-9]+$/", $_POST['amount'])){

I imagine that you really only want digits. BTW `-` if used in a character class should be at the end

Only thing wrong here is that he has a !, he needs to remove it and the 0-9 bit.

 

if($_POST['amount'] >= 1 && $_POST['amount'] <= $user_class->points && $_POST['price'] >= 1){

Use braces, or split into multiple lines for legability

Split into lines for legability, are you mad? /me imagines it and pukes

 

$result= mysql_query("INSERT INTO `pointsmarket` (owner, amount, price )"."VALUES ('$user_class->id', '$_POST[amount]', '$_POST[price]')");

Check the result, don't ignore it

This will throw an error anyway, the ) and VALUES are together

 

$user_class = new User($_SESSION['id']);

Say what now?

Guessing you've never seen GRPG, probably never heard of it either. User() is the user class used, so thats fine once again.

 

I gave up after this. More holes than a Glaswegian slapper's stockings after a hard Saturday night on the town.

Really, just really?

[ShadyCoco]

Basicly, Only problem I found when using it.

Is the input for removing points.

just add abs(intval()); around ALL inputs.

or under include 'header.php';

$_POST['amout'] = abs(intval($_POST['amount']));

for all number inputs.

Or even do it in the header and "secure" all files/ish

Maybe make 2-3 functions in classes and secure every file a little more.

And also danny I don't think Xanthia has worked with GRPG ^_^

Wish you the best with securing the pointmarket :)

[runthis]

@Danny696, with all do respect you like to quote tiny bits from peoples posts and eat it apart, but it would take less time to help the guy who started the topic.... just my two bits.

[Xanthia]

There checking its a number, why you talking about strings? So thats fine. ;)

Sorry, where are they checking? I see an assumption about data-type, and a coercion, there is no checking.

 

This will throw an error anyway, the ) and VALUES are together

Sure? MySQL does not need a space their. PHP will generate a warning of course however as the associated keys amount and price should really be quotation marks. Placing a new-line following the ". will split the line into a more manageable block which is possible what the original author had in mind.

 

Split into lines for legibility, are you mad?

Mad, no, however when you visually scan large quantities of source, I tend to find that missing multiple > and < (and/or => <= etc) becomes confusing. Extra braces would help, however there is nothing wrong with splitting the if statement across multiple lines; For example:

if (($_POST['amount'] >= 1)) &&
   ($_POST['amount'] <= $user_class->points) &&
   ($_POST['price']  >= 1)
  )
{

 

I will correct my point re. character classes however. It appears the the hyphen character can be at the start of a character class; my mistake. I would ask why something simpler like ctype_digit() or the more expensive preg_match("`^\d+$`,...) is not used instead.

 

Guessing you've never seen GRPG, probably never heard of it either. User() is the user class used, so thats fine once again.

Doesn't really make much sense to access the $user_class variable *above* where it is (re)created with new User(...). Since it is presumably created in the header include, I see no reason to duplicate it at this stage.

 

/me imagines it and pukes

Really, just really? Edited August 4, 2011 by Xanthia