<style type="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p> 
<body background="images/fundo2.JPG" text="#FFFFFF" leftmargin="0" topmargin="0">
<?php
$name = stripslashes($_POST['name']);
$login = stripslashes($_POST['login']);
$oldpwd = stripslashes($_POST['oldpwd']);
$vitality = stripslashes($_POST['vitality']);
$strength = stripslashes($_POST['strength']);
$energy = stripslashes($_POST['energy']);
$dexterity = stripslashes($_POST['dexterity']);

if ((eregi("[^a-zA-Z0-9_-]", $name)) || 
(eregi("[^a-zA-Z0-9_-]", $login)) ||
(eregi("[^a-zA-Z0-9_-]", $oldpwd)) ||
(eregi("[^a-zA-Z0-9_-]", $vitality)) ||
(eregi("[^a-zA-Z0-9_-]", $strength)) ||
(eregi("[^a-zA-Z0-9_-]", $energy)) ||
(eregi("[^a-zA-Z0-9_-]", $dexterity)))
	{
	echo("SQL Injection Detected");
        exit();
	}

require_once "sql_inject.php"; 
include_once('sql_check.php');
check_inject();

$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 

require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'"); 
$username_check = mssql_num_rows($sql_username_check); 

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

$query = "select Vitality,Strength,Energy,Dexterity,LevelUpPoint from Character WHERE Name='$name'";
$result = mssql_query( $query );
$row = mssql_fetch_row($result);

$new_vit = $row[0] + $vitality;
$new_str = $row[1] + $strength;
$new_eng = $row[2] + $energy;
$new_agi = $row[3] + $dexterity;
$row[4] = $row[4] - $vitality - $strength - $energy - $dexterity;

if (empty($login) || empty($oldpwd) || empty($name)) {
    echo "Error: some of the fields are empty. Go back and try again.<br>";
}

elseif ($username_check <= 0){ 
        echo "Error: Username not found, please go back and correct<br>"; }

elseif ($vitality<0 OR $strength<0 OR $energy<0 OR $dexterity<0){
	echo "Error: you're a pathetic loser! You cannot use this bug here!"; }

elseif ($row[4] < 0){ 
        echo "Error: you don't have enough points: ($row[4])!<br>"; }

elseif ($pw_check <= 0){ 
        echo "Error: the password you entered is incorrect! <br>"; }



else {	$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);
$msquery = "
UPDATE dbo.Character SET Vitality = '$new_vit'
WHERE Name = '$name'
AND AccountID = '$login'
UPDATE dbo.Character SET Strength = '$new_str'
WHERE Name = '$name'
AND AccountID = '$login'
UPDATE dbo.Character SET Energy = '$new_eng'
WHERE Name = '$name'
AND AccountID = '$login'
UPDATE dbo.Character SET Dexterity = '$new_agi'
WHERE Name = '$name'
AND AccountID = '$login'
UPDATE dbo.Character SET LevelUpPoint = '$row[4]'
WHERE Name = '$name'
AND AccountID = '$login'";

$sqlinject->test($msquery); 
$msresults= mssql_query($msquery);
echo "<font size='1' face='verdana'> $name's stats are now:<br>
<b>Vitality</b> = $new_vit<br>
<b>Strength</b> = $new_str<br>
<b>Energy</b> = $new_eng<br>
<b>Agility</b> = $new_agi<p>
You now have $row[4] points left.<br></font>";
}
?>
</body>
</html>
</body>
</html>