<style type="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p> 
<body background="file:///C|/AppServ/www/imagens/fundonews.gif" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<?php
$name = stripslashes($_POST['name']);
$login = stripslashes($_POST['login']);
$oldpwd = stripslashes($_POST['oldpwd']);

if ((eregi("[^a-zA-Z0-9_-]", $login)) || (eregi("[^a-zA-Z0-9_-]", $name)) || (eregi("[^a-zA-Z0-9_-]", $oldpwd)) )
	{
	echo("SQL Injection Detected");
        exit();
	}

require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

include_once('sql_check.php');
check_inject();

require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 



$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'"); 
$username_check = mssql_num_rows($sql_username_check); 

$sql_name_check = mssql_query("SELECT Name FROM Character WHERE Name='$name' and AccountID = '$login'"); 
$name_check = mssql_num_rows($sql_name_check); 

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 


if (empty($name) || empty($login) || empty($oldpwd))
{ echo "Error: <br>";
if (empty($name) || ($username_check <= 0) || ($name_check <= 0) || ($pw_check <= 0))
	echo "Campos foram deixados em branco.<br>";}

if ($username_check <= 0){ 
echo "Seu Login nao existe em nossa Data Base.<br>"; }

elseif ($name_check <= 0){ 
echo "Seu Character nao existe em nossa Data Base.<br>"; }

elseif ($pw_check <= 0){ 
echo "Sua Senha esta errada!<br>"; }

else {
$msquery = "UPDATE dbo.Character 
SET Inventory=NULL
WHERE AccountID = '$login'
AND Name = '$name' ";

$sqlinject->test($msquery);

$msresults= mssql_query($msquery);
echo "$name, Inventorio Limpado com Sucesso!!<br>";}
?>
</body>
</html>
</body>
</html>