<SCRIPT language=JavaScript>
var message="";
function clickIE() {if (document.all) {(message);return false;}}
function clickNS(e) {if 
(document.layers||(document.getElementById&&!document.all)) {
if (e.which==2||e.which==3) {(message);return false;}}}
if (document.layers) 
{document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;}
else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;}

document.oncontextmenu=new Function("return false")
</SCRIPT>
<style type="text/css">
<!--
@import url("../estilo.css");
body,td,th {
	color: #FFFFFF;
}
-->
</style>
<?PHP include("config.php");
require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 

$sqlinject->test($msquery); 
?>
<title>==Painel de Controle== [Mu Duel]</title><head>
<style type=text/css>
body{
scrollbar-face-color:#0066FF; 
scrollbar-highlight-color:#0066FF; 
scrollbar-3dlight-color:#0066FF; 
scrollbar-darkshadow-color:#000000; 
scrollbar-shadow-color:333333; 
scrollbar-arrow-color:0099FF; 
scrollbar-track-color:#000000;
font-family:Arial;
font-size:2;
}
.forms {font-family:arial;
font-size:12px;
font-family:Arial;
background-color:#222222;
color:#DDDDDD;
font-weight:bold;
border:1 solid #FFFFFF}
a {
color:#FFFFFF;
text-decoration: none;
}
a:hover {
color:#FFFFFF;
text-decoration: underline; 
}
</style>
<style type="text/css">
<!--
.style4 {font-size: 18px;
	color: #990000;
}
-->
</style>
<script language=javascript>
function validar(form) { 
str = document.pontos2.str.value;
agi = document.pontos2.agi.value;
vit = document.pontos2.vit.value;
nrg = document.pontos2.nrg.value;
if (str.indexOf("-") == -1) {
} else {
alert("Não use valores NEGATIVOS nos campos! \n"
     +"Usando negativos é possível bugar pontos, \n"
	 +"por isso desabilitamos esta função.");
pontos2.str.focus();
return false;
}
if (agi.indexOf("-") == -1) {
} else {
alert("Não use valores NEGATIVOS nos campos! \n"
     +"Usando negativos é possível bugar pontos, \n"
	 +"por isso desabilitamos esta função.");
pontos2.agi.focus();
return false;
}if (vit.indexOf("-") == -1) {
} else {
alert("Não use valores NEGATIVOS nos campos! \n"
     +"Usando negativos é possível bugar pontos, \n"
	 +"por isso desabilitamos esta função.");
pontos2.vit.focus();
return false;
}if (nrg.indexOf("-") == -1) {
} else {
alert("Não use valores NEGATIVOS nos campos! \n"
     +"Usando negativos é possível bugar pontos, \n"
	 +"por isso desabilitamos esta função.");
pontos2.nrg.focus();
return false;
}
}
   </script>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head>
<body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<div align="center"></div>
<p>&nbsp;</p>
<p>&nbsp;</p>
<table width="500" height="407" border="0" align="center" cellpadding="2" cellspacing="2" bordercolor="#CCCCCC" bgcolor="#000000">
  <tr><td width="37%" height="403" align="center" valign="top"><p align="center"> 
        <?php if ((isset($_COOKIE['login'])) AND (isset($_COOKIE['pass']))) {
$login = $_COOKIE['login'];
$senha = $_COOKIE['pass'];
$sql = "SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login' AND memb__pwd='$senha'";
$sqlinject->test($sql); 
$sql = mssql_query($sql); 
$logado = mssql_num_rows($sql);
if ($logado <= 0) {
echo '<table width="100%"  border="0" align="center" cellpadding="0" cellspacing="0">
<tr><td><div align="justify"><font size="2" face="Courier New, Courier, mono">
Area Acessecivel Apenas Para Usuarios Logados<BR><BR><BR><BR></div></td></tr>
<tr><td height="25" valign="top"><div align="center"><font color="#B30000" size="4" face="Courier New, Courier, mono"><strong>ACESSO USU&Aacute;RIOS </strong></font></div></td>
</tr><tr><td><form name="form1" method="post" action="logar.php">
<table width="100%"  border="0" cellspacing="1" cellpadding="1">
<tr><td><div align="right"><strong><font color="#B30000" size="3" face="Courier New, Courier, mono">Login:</font></strong></div></td>
<td><span class="style13"><INPUT name=login class="forms" id="login" size=15 maxLength=15>
</span></td></tr><tr><td><div align="right"><strong><font color="#B30000" size="3" face="Courier New, Courier, mono">Senha:</font></strong></div></td>
<td><span class="style11 style14"><INPUT name=senha type=password class="forms" id="senha" size=15 maxLength=15>
</span></td></tr><tr><td><div align="right"></div></td><td><span class="style13">
<input name="cria" type="submit" class="forms" id="cria" value="ENTRAR"></td></tr></table>
</form></td></tr><tr><td>&nbsp;</td></tr></table>';
exit(); } 

echo '<table width="100%"  border="0" cellspacing="7" cellpadding="0"><tr>
<td align="right" valign="middle"><div align="center"><font color="#FFFFFF" size="3" face="Courier New"><strong>Ol&aacute; ';
	echo $_COOKIE["nome"];
	echo '!</div><br></td>
  </tr><tr>
    <td align="right" valign="middle"><a href="manager.php"><font size="2" face="Courier New"><strong>Minha Conta</a></td>
  </tr><tr>
    <td align="right" valign="middle"><a href="mudasenha.php"><font size="2" face="Courier New"><strong>Mudar Senha</a></td>
  </tr>    <tr>
    <td align="right" valign="middle"><a href="pontos.php"><font size="2" face="Courier New"><strong>Distribuir Pontos</a></td>
  </tr><tr>
    <td align="right" valign="middle"><a href="pk.php"><font size="2" face="Courier New"><strong>Limpar PK</a></td>
  </tr><tr>
    <td align="right" valign="middle"><a href="logout.php"><font size="2" face="Courier New"><strong>Sair</a></td>
  </tr></table>';
} else {
echo '<table width="100%"  border="0" align="center" cellpadding="0" cellspacing="0">
<tr><td><div align="center"><font size="2" face="Courier New, Courier, mono" color="#B30000">
<BR><BR>Area Assesivel Apenas Para Usuarios Logados<BR>Loge-se e Diverta-se<BR><BR><BR></div></td></tr>
<tr><td height="25" valign="top"><div align="center"><font color="#B30000" size="4" face="Courier New, Courier, mono"><strong>Painel do Usuario</strong></font></div></td>
</tr><tr><td><form name="form1" method="post" action="logar.php">
<table width="100%"  border="0" cellspacing="1" cellpadding="1">
<tr><td><div align="right"><strong><font color="#B30000" size="3" face="Courier New, Courier, mono">Login:</font></strong></div></td>
<td><span class="style13"><INPUT name=login class="forms" id="login" size=15 maxLength=15>
</span></td></tr><tr><td><div align="right"><strong><font color="#B30000" size="3" face="Courier New, Courier, mono">Senha:</font></strong></div></td>
<td><span class="style11 style14"><INPUT name=pass type=password class="forms" id="pass" size=15 maxLength=15>
</span></td></tr><tr><td><div align="right"></div></td><td><span class="style13">
<input name="cria" type="submit" class="forms" id="cria" value="Entrar"></td></tr></table>
</form></td></tr><tr><td>&nbsp;</td></tr></table>';
exit(); } ?>
      </p>
      <p align="center">&nbsp;</p></td><td width="63%" align="center" valign="top"><div align="center"> 
        <?php
if (empty($_POST['name']) and empty($_POST['str'])) {
	$login = stripslashes($_COOKIE['login']);
	$login = htmlspecialchars($login,ENT_QUOTES);
	
	echo '<p><strong><font color="#FFFFFF" size="1" face="Courier New">DISTRIBUIÇÃO DE PONTOS</font></strong></p>
	<form action="" method="post" name="pontos" id="pontos">
        <table width="90%" border=0 align=center cellpadding=0 cellspacing=0>
            <tr valign="top">
              <td height="40" colspan=2 align=center><div align="center">
                 <font color="#FFFFFF"> Escolha na lista abaixo o personagem que voc&ecirc; deseja editar:<br><br>
              </div><br></td>
            </tr>
            <tr>
              <td width="50%" valign="top"><div align="right"><font color="#FFFFFF">Personagem:</div></td>
              <td width="50%">
                <div align="left">';
$query = "select Name from Character where AccountID = '$login'";
$result = mssql_query($query);
echo '<select name="name" size="5" class="forms">';
for($i=0;$i<mssql_num_rows($result);++$i)
{
$row = mssql_fetch_row($result);
echo '<option value="';
echo $row[0];
echo '">';
echo $row[0];
echo '</option>';
}
echo '</select>';
$conn=mssql_close();
echo '</div></td>
            </tr>
            <tr align="center">
              <td>&nbsp;</td>
              <td><div align=left><br><input name="Submit" type="submit" value="Distribuir Pontos" class="forms">
              </div>
              </td>
            </tr>
  </table>
</form>
';
  }
elseif (!empty($_POST['name']) and empty($_POST['str']) and empty($_POST['agi']) and empty($_POST['vit']) and empty($_POST['nrg']))
  {
$login = stripslashes($_COOKIE['login']);
$login = htmlspecialchars($login,ENT_QUOTES);
$name = stripslashes($_POST['name']);
$name = htmlspecialchars($name,ENT_QUOTES);
$sql_username_check = "SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'";
$sqlinject->test($sql_username_check); 
$sql_username_check = mssql_query($sql_username_check); 
$username_check = mssql_num_rows($sql_username_check); 
$sql_perso_check = "SELECT Name FROM Character WHERE AccountID = '$login'";
$sqlinject->test($sql_perso_check); 
$sql_perso_check = mssql_query($sql_perso_check); 
$perso_check = mssql_num_rows($sql_perso_check); 
$sql_name_check = "SELECT * FROM Character WHERE Name = '$name' and AccountID='$login'";
$sql_name_check = mssql_query($sql_name_check); 
$name_check = mssql_num_rows($sql_name_check);
$sql = mssql_query("select LevelUpPoint from Character where Name='$name'");
$for = mssql_query("select Strength from Character where Name='$name'");
$agi = mssql_query("select Dexterity from Character where Name='$name'");
$vit = mssql_query("select Vitality from Character where Name='$name'");
$ene = mssql_query("select Energy from Character where Name='$name'");
$pontos = mssql_result($sql, 0,0);
if ($pontos <= 0) {
echo "<div align=\"center\"><BR><BR><BR>Ops! Voc&ecirc; n&atilde;o tem pontos para adicionar neste personagem!</div>";
}
else {
echo '<p><strong><font color="#006699" size="1" face="Verdana">DISTRIBUIÇÃO DE PONTOS</font></strong></p>
<form name="pontos2" method="post" onSubmit="return validar(this)" action="">
<input name="name" type="hidden" value='; echo $name; echo '>
          <table width="100%" border="0" cellspacing="3" cellpadding="3">
            <tr> 
              <td width="50%"><div align="right"><font size=2><font color="#FFFFFF">Dispon&iacute;veis:</td>
              <td colspan="3"><div align="left"><font size=2><font color="#FFFFFF">';
echo mssql_result($sql, 0,0);
echo ' </div>
      </td>
      </tr>
<tr> 
              <td width="50%" height="19"><div align="right"><font size=2><font color="#FFFFFF">Adicionar em Força:</td>
              <td colspan="3"><div align="left"><font size=2><input name="str" class="forms" type="text" id="str" value="0" size="3" maxlength="5"><font color="#FFFFFF">
';
echo mssql_result($for, 0,0);
echo '<font color="#FFFFFF"> atualmente</font></div></td>
            </tr>
            <tr> 
              <td width="50%"><div align="right"><font size=2><font color="#FFFFFF">Adicionar em Agilidade:</td>
              <td colspan="3"><div align="left"><font size=2>
			  <input name="agi" class="forms" type="text" id="agi" value="0" size="3" maxlength="5"><font color="#FFFFFF">
';
echo mssql_result($agi, 0,0);
echo '<font color="#FFFFFF"> atualmente</div></td>
            </tr>
            <tr>
              <td width="50%" height="22"><div align="right"><font size=2><font color="#FFFFFF">Adicionar em Vitalidade:</td>
              <td colspan="3"><div align="left"><font size=2>
			  <input name="vit" class="forms" type="text" id="vit" value="0" size="3" maxlength="5"><font color="#FFFFFF">
';
echo mssql_result($vit, 0,0);
echo '<font color="#FFFFFF"> atualmente</font></div></td>
            </tr>
            <tr>
              <td width="50%" height="22"><div align="right"><font size=2><font color="#FFFFFF">Adicionar em Energia:</td>
              <td colspan="3"><div align="left"><font size=2>
			  <input name="nrg" class="forms" type="text" id="nrg" value="0" size="3" maxlength="5"><font color="#FFFFFF">
';
echo mssql_result($ene, 0,0);
echo '<font color="#FFFFFF"> atualmente</div></td>
            </tr>
            <tr> 
              <td width="50%"> </td>
              <td width="50%"><div align="left">
			  <input type="submit" class="forms" name="Submit" value="Distribuir"></div>
              </td>
            </tr>
     </table>
    </form>';
} }// }
else {
$login = stripslashes($_COOKIE['login']);
$login = htmlspecialchars($login,ENT_QUOTES);
$name = stripslashes($_POST['name']);
$name = htmlspecialchars($name,ENT_QUOTES);
$psstr = stripslashes($_POST['str']);
$str = htmlspecialchars($psstr,ENT_QUOTES);
$psagi = stripslashes($_POST['agi']);
$agi = htmlspecialchars($psagi,ENT_QUOTES);
$psvit = stripslashes($_POST['vit']);
$vit = htmlspecialchars($psvit,ENT_QUOTES);
$psnrg = stripslashes($_POST['nrg']);
$nrg = htmlspecialchars($psnrg,ENT_QUOTES);
$sql_username_check = "SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'";
$sqlinject->test($sql_username_check); 
$sql_username_check = mssql_query($sql_username_check); 
$username_check = mssql_num_rows($sql_username_check); 
$sql_name_check = "SELECT * FROM Character WHERE Name = '$name' and AccountID='$login'";
$sql_name_check = mssql_query($sql_name_check); 
$name_check = mssql_num_rows($sql_name_check); 
$sql = "select LevelUpPoint from Character where Name='$name' and AccountID='$login'";
$sql = mssql_query($sql);
if ( $str=="" || $agi=="" || $vit=="" || $nrg=="") {
    echo "<BR><BR><BR>Existem campos em branco. Por favor volte e corrija.<br>
	Para não adicionar pontos a um stat, deixe o campo com 0 (zero).";
}
elseif ($str + $agi + $vit + $nrg > mssql_result($sql, 0, 0)) {
echo "<BR><BR><BR>Coloque apenas a quantidade de pontos disponíveis!";}
else {
$sql = mssql_query("
UPDATE Character
SET Strength = Strength + '$str' ,
Dexterity = Dexterity + '$agi' ,
Vitality = Vitality + '$vit' ,
Energy = Energy + '$nrg' ,
LevelUpPoint = LevelUpPoint - ($str+$agi+$vit+$nrg)
WHERE AccountID = '$login'
AND Name = '$name'");
echo "<BR><BR><BR>Pontos Adicionados Com Sucesso!<BR><BR> Use Sempre Esse Sistema <BR><BR>";
}
}
function anti_injection($sql)
{
	// remove palavras que contenham sintaxe sql
	$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
	$sql = trim($sql);//limpa espaços vazio
	$sql = strip_tags($sql);//tira tags html e php
	$sql = addslashes($sql);//Adiciona barras invertidas a uma string
	return $sql;
}	
	 ?>
        <p>&nbsp;</p>
      </div></td>
</tr></table>
</body></html>