<LINK REL="StyleSheet" HREF="style.css" TYPE="text/css">
<!--
.style1 {
color: #FF0000;
font-size: 14px;
**
-->
</style>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="1" style="border-left:1px solid #666666;border-right:1px solid #666666"></td>
</tr>
</table>
<html>
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="img/css.css" rel="stylesheet" type="text/css">
<p> 
<body leftmargin="0" topmargin="0">
<?php
$name = stripslashes($_POST['name']);
$login = stripslashes($_POST['login']);
$oldpwd = stripslashes($_POST['oldpwd']);

require 'config.php';
include_once('sql_check.php');
check_inject();

$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 

if ((eregi("[^a-zA-Z0-9_-]", $name)) || (eregi("[^a-zA-Z0-9_-]", $login)) ||(eregi("[^a-zA-Z0-9_-]", $oldpwd))) 
	{
	echo("SQL Injection Detected - Remember, only use numbers and letters!");
        exit();
	}


$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'"); 
$username_check = mssql_num_rows($sql_username_check); 

$sql_name_check = mssql_query("SELECT Name FROM Character WHERE Name='$name' and AccountID = '$login'"); 
$name_check = mssql_num_rows($sql_name_check); 

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

$sql_online_check = mssql_query("SELECT * FROM MEMB_STAT WHERE ConnectStat=0 AND memb___id='$login'");
$online_check = mssql_num_rows($sql_online_check); 

$result = mssql_query("Select Clevel From Character where Name='$name'");
$row = mssql_fetch_row($result);

$sql_reset_check = mssql_query("Select Name, Resets from Resets where Name='$name'");
$reset_check = mssql_num_rows($sql_reset_check);
$reset = mssql_fetch_row($sql_reset_check);

$reset_points_fixed = ($reset_points*($reset[1]+1));

if (empty($name) || empty($login) || empty($oldpwd)){
	echo "Error: some fields were left blank. Please go back and try again.<br>";}

elseif ($username_check <= 0){ 
echo "Your Login does not exist in our database. Please go back and try again.<br>";}

elseif ($name_check <= 0){ 
echo "Your Character does not exist in your account and / or in our database. Please go back and try again.<br>"; }

elseif ($online_check <= 0){ 
echo "Please logoff before using the reset reward system!<br>"; }

elseif ($row[0] < 349){ 
        echo "Error: Your Level ($row[0]) Is Not High Enough!<br>"; }

elseif ($pw_check <= 0){ 
echo "Your Password Seems To Be Invalid!<br>"; }

else {

IF ($reset_check <= 0 AND $row[0]=350 AND $reset_reward==points)
	{
	$general = 
		"UPDATE Character
SET clevel= ('1') , experience= ('0') , LevelUpPoint= ('300')+('300')*Resets , Resets = Resets+1 , Strength= ('18') , Dexterity= ('18') , Vitality= ('15') , Energy= ('30') , Life= ('100') , MaxLife= ('100') , Mana= ('100') , MaxMana= ('100') , Inventory= NULL , MagicList= NULL , Money= Money-('70000000')
FROM Character join Memb_Stat on Character.Accountid = Memb_Stat.memb___id
collate Latin1_general_CI_AS
WHERE clevel= ('350') and Resets<('100') and Money>('69999999') AND Memb_Stat.ConnectStat = 0

;
	}


ELSEIF ($reset_check > 0 AND $row[0]=350 AND $reset_reward==points)
	{
	$new_reset = $reset[1]+1;
	$general = 
		"
		UPDATE dbo.Character SET clevel=1
		WHERE Name = '$name'
		UPDATE dbo.Character SET Experience = '0'
		WHERE Name = '$name'
		Update dbo.Character SET vitality = '20'
		WHERE Name='$name'
		Update dbo.Character SET dexterity = '20'
		WHERE Name='$name'
		Update dbo.Character SET energy = '20'
		WHERE Name='$name'
		Update dbo.Character SET strength = '20'
		WHERE Name='$name'
		Update dbo.Character SET  LevelUpPoint ='$reset_points_fixed'
		WHERE Name='$name'
		Update dbo.Resets SET Resets = '$new_reset'
		WHERE Name='$name'
		";
	}


ELSEIF ($reset_check <= 0 AND $row[0]=350 AND $reset_reward==none)
	{
	$general = 
		"
		UPDATE dbo.Character SET clevel=1
		WHERE Name = '$name'
		UPDATE dbo.Character SET Experience = '0'
		WHERE Name = '$name'
		INSERT INTO Resets (Name, Resets) VALUES ('$name', 1)
		";
	}


ELSEIF ($reset_check > 0 AND $row[0]=350 AND $reset_reward==none)
	{
	$new_reset = $reset[1]+1;
	$general = 
		"
		UPDATE dbo.Character SET clevel=1
		WHERE Name = '$name'
		UPDATE dbo.Character SET Experience = '0'
		Update dbo.Resets SET Resets = '$new_reset'
		WHERE Name='$name'
		";
	}
ELSEIF ($row[0] != 350)
	{
	$general = " ";
	}

$sqlinject->test($general);
$msgeneral = mssql_query($general);

echo "$name is successfully resetted and has been rewarded likewise. You now have $new_reset reset(s) ";
}


?>
</body>
</html>
</body>
</html>