<html>
<head>
<title>TGBR Page Millenium  -   http://www.thegamebr.rg.com.br/</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<?PHP 
include("config.php");
 ?>
 <?PHP include("config.php");
require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 
require 'config.php';
?>
<script language="JavaScript">
 function blockError(){return true;}
 window.onerror = blockError;
 </script>
<script language=JavaScript>
 function disableselect(e) {
    return false
 } 
 function reEnable() {
    return true
 }
 //if IE4+
 document.onselectstart=new Function ("return false")
 //if NS6
 if (window.sidebar) { 
    document.onmousedown=disableselect
    document.onclick=reEnable
 }
 </script>
<SCRIPT language=JavaScript>
<!--

var message="Gosto do site né safado! ta querendo copiar o que?";


function clickIE4(){
if (event.button==2){
alert(message);
return false;
}
}

function clickNS4(e){
if (document.layers||document.getElementById&&!document.all){
if (e.which==2||e.which==3){
alert(message);
return false;
}
}
}

if (document.layers){
document.captureEvents(Event.MOUSEDOWN);
document.onmousedown=clickNS4;
}
else if (document.all&&!document.getElementById){
document.onmousedown=clickIE4;
}

document.oncontextmenu=new Function("alert(message);return false")

// --> 
</SCRIPT>
<title></title>
<link href="style.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--
.style3 {font-family: Arial, Helvetica, sans-serif}
.style5 {font-family: Arial, Helvetica, sans-serif; font-size: 11px; }
.style7 {
	font-family: Arial, Helvetica, sans-serif;
	font-size: 11px;
	color: #333333;
	font-weight: bold;
}
.style8 {
	font-size: 11px;
	color: #333333;
}
-->
</style>
<body background="images/fundo2.JPG">
<table width="410" border="0" cellpadding="0" cellspacing="0">
  <!--DWLayoutTable--> 
            <tbody>
              <tr>
                <td width="391" height="21" align="center" valign="top" background="siteMain_data/event_09.gif"><div align="left" class="style5 style8">
                    <p align="left">
                      <?php require'config.php';
echo $servername; ?>
                    </p>
                </div>
                </td>
              <td width="19">&nbsp;</td>
              </tr>
              <tr>
                <td height="20" align="center" valign="top" background="siteMain_data/event_09.gif"><div align="left">
                  <h3><span class="style3"><span class="style5">
                  <a name="anchor"></a> </span></span></h3>
                </div>
                </td>
              <td></td>
              </tr>
              <tr>
                <td height="111" colspan="2" align="center" valign="top" background="siteMain_data/event_09.gif"><span class="style7"> 
                  <?php
$name = stripslashes($_POST['name']);
$login = stripslashes($_POST['login']);
$oldpwd = stripslashes($_POST['oldpwd']);
$map= stripslashes($_POST['map']);

require 'config.php';
include_once('sql_check.php');
check_inject();

$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);

require_once "sql_inject.php"; 
$bDestroy_session = TRUE; 
$url_redirect = 'index.php'; 
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect)  ; 
if ((eregi("[^a-zA-Z0-9_-]", $name)) || (eregi("[^a-zA-Z0-9_-]", $login)) ||(eregi("[^a-zA-Z0-9_-]", $oldpwd))) 
	{
	echo("SQL Injection Detected - Remember, only use numbers and letters!");
        exit();
	}

elseif($warpcharacter==0){
echo ("Option Disabled!");
exit();}

$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'"); 
$username_check = mssql_num_rows($sql_username_check); 

$sql_name_check = mssql_query("SELECT Name FROM Character WHERE Name='$name' and AccountID = '$login'"); 
$name_check = mssql_num_rows($sql_name_check); 

$sql_pw_check = mssql_query("SELECT memb__pwd FROM MEMB_INFO WHERE memb__pwd='$oldpwd' and memb___id='$login'"); 
$pw_check = mssql_num_rows($sql_pw_check); 

$sql_online_check = mssql_query("SELECT * FROM MEMB_STAT WHERE ConnectStat=0 AND memb___id='$login'");
$online_check = mssql_num_rows($sql_online_check); 

$result = mssql_query("Select Money From Character where Name='$name'");
$row = mssql_fetch_row($result);

$sql_vip_check = mssql_query("SELECT vip FROM MEMB_INFO WHERE memb___id='$login'");
list($vip_code) = mssql_fetch_array($sql_vip_check);


$lorenciamoney=$row[0] - ($lorenciazen);
$noriamoney=$row[0] - ($noriazen);
$daviasmoeny=$row[0] - ($daviaszen);
$dungeonmoney=$row[0] - ($dungeonzen);
$atlansmoney=$row[0] - ($atlanszen);
$tarkanmoney=$row[0] - ($tarkanzen);
$losttowermoney=$row[0] - ($losttowerzen);
$arenamoney=$row[0] - ($arenazen);


if (empty($name) || empty($login) || empty($oldpwd)){
	echo "Preencha todos os campos.<br>";}


elseif ($username_check <= 0){ 
echo "Seu login não existe.<br>";}

elseif ($name_check <= 0){ 
echo "Seu personagem não existe.<br>"; }

elseif ($vip_code == 0){
echo "Desculpe, mas este recurso só pode ser utilizado por contas VIP.<br>"; }

elseif ($pw_check <= 0){ 
echo "Senha Invalida!<br>"; }

elseif ($online_check <= 0){ 
echo "Saia do jogo para poder teleportar!<br>"; }

elseif ($map==maps){ 
echo "Por favor selecione o mapa que deseja teleportar!"; }

elseif ($map==lorencia and  $lorenciamoney < 0){ 
echo "Você precisa de $lorenciazen zen!"; }


elseif ($map==noria and  $noriamoney < 0){ 
echo "Você precisa de $noriazen zen!"; }


elseif ($map==davias and  $daviasmoeny < 0){ 
echo "Você precisa de $daviaszen zen!"; }


elseif ($map==dungeon and  $dungeonmoney < 0){ 
echo "Você precisa de $dungeonzen zen!"; }


elseif ($map==losttower and  $losttowermoney < 0){ 
echo "Você precisa de $losttowerzen zen!"; }


elseif ($map==tarkan and  $tarkanmoney < 0){ 
echo "Você precisa de $tarkanzen zen!"; }


elseif ($map==atlans and  $atlansmoney < 0){ 
echo "Você precisa de $atlanszen zen!"; }


elseif ($map==arena and  $arenamoney < 0){ 
echo "Você precisa de $arenazen zen!"; }


else {

IF ($map==lorencia)
	{
	$general = 
		"
                UPDATE dbo.Character SET MapNumber = '0'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '125'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '125'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$lorenciamoney'
                WHERE Name = '$name'
		";
	}


ELSEIF ($map==noria)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '3'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '175'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '115'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$noriamoney'
                WHERE Name = '$name'
		";
	}


ELSEIF ($map==davias)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '2'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '207'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '43'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$daviasmoney'
                WHERE Name = '$name'
		";
	}

ELSEIF ($map==dungeon)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '1'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '125'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '125'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$dungeonmoney'
                WHERE Name = '$name'
		";
	}


ELSEIF ($map==atlans)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '7'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '23'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '18'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$atlansmoney'
                WHERE Name = '$name'
		";
	}


ELSEIF ($map==losttower)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '4'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '206'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '80'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$losttowermoney'
                WHERE Name = '$name'
		";
	}

ELSEIF ($map==tarkan)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '8'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '192'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '59'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$ltarkanmoney'
                WHERE Name = '$name'
		";
	}

ELSEIF ($map==arena)
	{
	$general = 
		"
	                UPDATE dbo.Character SET MapNumber = '8'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosX= '64'
		WHERE Name = '$name'
		UPDATE dbo.Character SET MapPosY= '49'
		WHERE Name = '$name'
		UPDATE dbo.Character SET money = '$arenamoney'
                WHERE Name = '$name'
		";
	}



$sqlinject->test($general);
$msgeneral = mssql_query($general);

echo "$name Acaba de mover-se para $map ";
}


?>
                </span></td>
              </tr>
            </tbody>
</table>
