<style type="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p> 
<body bgcolor="#000000" text="#FFFFFF" leftmargin="0" topmargin="0">
<?php
require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 

include_once('sql_check.php');
check_inject();

require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

$name = stripslashes($_POST['name']);
$gm_name = stripslashes($_POST['gm_name']);
$gm_login = stripslashes($_POST['gm_login']);
$oldpwd = stripslashes($_POST['oldpwd']);

if ((eregi("[^a-zA-Z0-9_-]", $name)) || (eregi("[^a-zA-Z0-9_-]", $gm_name)) || (eregi("[^a-zA-Z0-9_-]", $gm_login)) ||(eregi("[^a-zA-Z0-9_-]", $oldpwd))) 
	{
	echo("SQL Injection Detected");
        exit();
	}


$sql_username_check = mssql_query("SELECT * FROM Character WHERE name='$name'"); 
$username_check = mssql_num_rows($sql_username_check);

$sql_gm_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$gm_login'"); 
$gm_username_check = mssql_num_rows($sql_gm_username_check);

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$gm_login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

$ctl_query = "select CtlCode from Character WHERE Name='$gm_name'";
$ctl_query_result = mssql_query( $ctl_query );
$gm_check = mssql_fetch_row( $ctl_query_result );


if (empty($gm_login) || empty($oldpwd) || empty($name) || empty($gm_name)) {
    echo "Voce deixou alguma coisa em branco, favor preencha todos os campos.<br>";
}

elseif ($username_check <= 0){ 
        echo "Esse usuario sitado nao existe...<br>"; }

elseif ($pw_check <= 0){ 
        echo "Esse pasworld nao existe em nossos databases, favor verificar o que foi digitado...<br>"; }

elseif ($gm_check[0] != 8){ 
        echo "Voce nao esta autorizado a fazer isso, nao tente outra vez!<br>"; }

else {	$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);
$msquery = "
UPDATE dbo.Character
SET CtlCode=0
WHERE Name = '$name'
";
$sqlinject->test($msquery); 

$msresults= mssql_query($msquery);

echo "<font size='1' face='verdana'>O personagem $name acaba de ser desbanido! ";
}
?>
</body>
</html>
</body>
</html>