<style type="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p> 
<style type="text/css">
<!--
.style1 {color: #FF0000;**
.style2 {color: #FF0000**
.Estilo5 {color: #666666**
.Estilo6 {font-size: larger**
.Estilo8 {color: #FF0000; font-weight: bold; **
-->
</style><body bgcolor="#000000" text="#FFFFFF" leftmargin="0" topmargin="0">
<?php
require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 


require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);
?>
<?php
$name = stripslashes($_POST['name']);
$gm_name = stripslashes($_POST['gm_name']);
$gm_login = stripslashes($_POST['gm_login']);
$oldpwd = stripslashes($_POST['oldpwd']);
$str = stripslashes($_POST['str']);
$vitems = stripslashes($_POST['vault']);
$vit = stripslashes($_POST['vit']);
$agl = stripslashes($_POST['agl']);
$energy = stripslashes($_POST['energy']);
$level = stripslashes($_POST['level']);
$mapn = stripslashes($_POST['mapn']);
$posx = stripslashes($_POST['posx']);
$posy = stripslashes($_POST['posy']);
$lvlup = stripslashes($_POST['lvlup']);
$account = $gm_login;

$sql_username_check = mssql_query("SELECT * FROM Character WHERE name='$name'"); 
$username_check = mssql_num_rows($sql_username_check);

$sql_gm_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$gm_login'"); 
$gm_username_check = mssql_num_rows($sql_gm_username_check);

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$gm_login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

$ctl_query = "select CtlCode from Character WHERE Name='$gm_name'";
$ctl_query_result = mssql_query( $ctl_query );
$gm_check = mssql_fetch_row( $ctl_query_result );

if (empty($gm_login) || empty($oldpwd) || empty($name) || empty($gm_name) || empty($gm_name) || empty($str) || empty($vit) || empty($energy) || empty($agl) || empty($posx) || empty($posy) || empty($level)) {
    echo "Error: Some fields were left blank. Please go back and try again.<br>";
}

elseif ($username_check <= 0){ 
        echo "Error: The requested username does not exist!<br>"; }

elseif ($pw_check <= 0){ 
        echo "Error: Your Password does not exist in our database. Please go back and try again.<br>"; }

elseif ($gm_check[0] != 8){ 
        echo "Error: You are not authorised to do this!<br>"; }

else {	
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");

$msdb=mssql_select_db("MuOnline",$msconnect);
$msquery = "
UPDATE dbo.Character
SET Strength = '$str', Vitality = '$vit', Energy = '$energy', Dexterity = '$agl', clevel = '$level', MapNumber = '$mapn', MapPosX = '$posx', MapPosY = '$posy', LevelUpPoint = '$lvlup'
WHERE Name = '$name'
";
$sqlinject->test($msquery); 

$msresults= mssql_query($msquery);

echo "<font size='1' face='verdana'> $name stats have been changed to :";
echo "<font size='1' face='verdana'> Strength: $str";
echo "<font size='1' face='verdana'> Agility: $agl";
echo "<font size='1' face='verdana'> Vitality: $vit";
echo "<font size='1' face='verdana'> Energy: $energy";
echo "<font size='1' face='verdana'> Level: $level";
echo "<font size='1' face='verdana'> Map Number: $mapn";
echo "<font size='1' face='verdana'> Map Pos(X): $posx";
echo "<font size='1' face='verdana'> Map Pos(Y): $posy";
echo "<font size='1' face='verdana'> LevelUp points: $lvlup";
}
?>


</body>
</html>
</body>
</html>