Is this script buggy?

imhere2009 · January 29, 2007

Hi all

First off how do i post php code onto the forums? cant seem to find out how and then i have a script i would like you guys just to look at.

Thanks
steve

Jessica · January 29, 2007

Copy, Paste, Highlight and hit the # button.

imhere2009 · January 29, 2007

Hi

thank you . here is the code i have that needs the once over, please bare with me im still learning php

[code=php:0]<?

include("html.php");

$res = mysql_fetch_array(mysql_query("SELECT res FROM $tab[pimp] WHERE id='$id';"));

if((maxlength($reserves) != bad) && ($reserves > 0) && (!preg_match ('[0-9]', $reserves)) && (!strstr($reserves,"+")) && (!strstr($reserves,"*")) && (!strstr($reserves,"-")) && (!strstr($reserves,".")) && ($reserves <= $res[0]))

{

mysql_query("UPDATE $tab[pimp] SET trn=trn+$reserves, res=res-$reserves WHERE id='$id';");

}

$pmp = mysql_fetch_array(mysql_query("SELECT pimp,rank,nrank,city,networth,money,trn,res,condom,medicine,crack,weed,glock,shotgun,uzi,ak47,whore,thug,whappy,thappy,payout,crew,msg,atk,ivt,lowrider,attin,attackout,lastattackby,lastattack,cmsg,hummer,bike FROM $tab[pimp] WHERE id='$id';"));

$crw = mysql_fetch_array(mysql_query("SELECT name,founder,icon FROM $tab[crew] WHERE id='$pmp[21]';"));

$cty = mysql_fetch_array(mysql_query("SELECT name FROM $tab[city] WHERE id='$pmp[3]';"));

// turn info

$turnupdate = mysql_fetch_array(mysql_query("SELECT lastran FROM $tab[cron] WHERE cronjob='turns';"));

$game = mysql_fetch_array(mysql_query("SELECT speed,maxbuild,prize,other,startjackpot FROM $tab[game] WHERE round='$tru';"));

$tw=$pmp[12]+$pmp[13]+$pmp[14]+$pmp[15];

$figure=$time - $pmp[28];

$count=round($figure / (60*60*24));

$tillmax=number_format(((($game[1] - $pmp[6])/($game[0] * 6))*60)*60,0);

$tillmax = strtotime("+".str_replace(' ','',str_replace(',','',$tillmax))." seconds", $turnupdate[0]);

$supstatus = mysql_fetch_array(mysql_query("SELECT status,statusexpire FROM $tab[user] WHERE id='$id1';"));

GAMEHEADER("Main Menu");

?>

<table width="100%" align="center" cellspacing="0" cellpadding="12" border="0">

<tr>

<td align="center" valign="top">

<table width="100%">

<tr>

<td valign="top"><table cellspacing="0" cellpadding="0"><tr><?if($crw[2]){?><td height="32" valign="bottom"><a href="crew.php?cid=<?=$pmp[21]?>&tru=<?=$tru?>"><img src="<?=$crw[2]?>" border="0" width="32" height="32"></a> </td><?}?><td> <?
$days = ($supstatus[1]-$time);
$daysleft = round($days/86400);
if($supstatus[0] == admin || $supstatus[0] == supporter AND $supstatus[1] != 0){?>
You are a supporter for <?=$daysleft?> more days.
<?} elseif($supstatus[1] == 0) {?>
You are a supporter for unlimited time.
<?}?>
 
Currently ranked <?=$pmp[1]?> in <?=$cty[0]?>, <?=$pmp[2]?> National Currently worth $<?=commas($pmp[4])?> <?if($pmp[21] > 0){?> <?if($pmp[0] == $crw[1]){?>founder of<?}else{?>member of<?}?> <a href="crew.php?cid=<?=$pmp[21]?>&tru=<?=$tru?>"><?=$crw[0]?></a>.<?}?></td></tr></table></td>

<td align="right" valign="top"><a href="mailbox.php?tru=<?=$tru?>">Open Mailbox</a> 
<?if($pmp[22] == 1){?>you have 1 new message<?}elseif($pmp[22] > 1){?>you have <?=$pmp[22]?> new messages<?}else{?>you have no new messages<?}?><?if($pmp[23] == 1){?> you have been attacked!<?}elseif($pmp[23] > 1){?> you have been attacked <?=$pmp[23]?> times!<?}?><?if($pmp[24] == 1){?> you have a invitation!<?}elseif($pmp[24] > 1){?> you have <?=$pmp[24]?> new invitations!<?}elseif($pmp[30] > 0){?> <a href="cboard.php?cid=<?=$pmp[21]?>&tru=<?=$tru?>"><?=$pmp[30]?> new crew message</a><?}?></td>

</tr>

</table>

<?if($bigman){?><?=$bigman?> <?}?>
  



 <?=commas($pmp[6])?> turns and $<?=commas($pmp[5])?> cash on hand.

<?if($pmp[6] < $game[1]){?> Max turns in <?=countup($tillmax);?> <? } else { ?> You have reached the maximum turns for this round <?}?>

<?if($takeout == reserves){?> <form method="post" action="index.php?tru=<?=$tru?>">how many turns would you like to add?  <input maxlength="7" type="text" class="text" size="7" name="reserves"> <input maxlength="7" type="submit" class="button" value="apply"></form><?}else{?>

<?if($pmp[7] != 0){?> <a href="?takeout=reserves&tru=<?=$tru?>">you also have <?=commas($pmp[7])?> reserve turns</a><?}?>

<?}?>

 

 

<table>

<tr>

<td>

<table>

<tr><td align="right">Weapons:</td><td> </td></tr>

<tr><td align="right">Glocks:</td><td><?=commas($pmp[12])?></td></tr>

<tr><td align="right">Shotguns:</td><td><?=commas($pmp[13])?></td></tr>

<tr><td align="right">Uzi's:</td><td><?=commas($pmp[14])?></td></tr>

<tr><td align="right">AK-47's:</td><td><?=commas($pmp[15])?></td></tr>

<tr><td align="right">Accessories</td><td> </td></tr>

<tr><td align="right">Condoms:</td><td><?=commas($pmp[8])?></td></tr>

<tr><td align="right">Meds:</td><td><?=commas($pmp[9])?></td></tr>

<tr><td align="right">Crack:</td><td><?=commas($pmp[10])?></td></tr>

<tr><td align="right">Weed:</td><td><?=commas($pmp[11])?></td></tr>

<?if($pmp[25] > 0){?><tr><td align="right">Rides:</td><td> </td></tr><tr><td align="right">Lowriders:</td><td><?=commas($pmp[25])?></td></tr><?}?>
<?if($pmp[31] > 0){?><tr><td align="right">Hummers:</td><td><?=commas($pmp[31])?></td></tr><?}?>
<?if($pmp[32] > 0){?><tr><td align="right">Bikes:</td><td><?=commas($pmp[32])?></td></tr><?}?>

</table>

</td>

<td width="50"></td>

<td>

<table>

<tr>

<td>



<?=commas($pmp[17])?> Thugs

 <?=$pmp[19]?>% Happy, with

 <?=commas($tw)?> weapons total



</td>

</tr>

</table>

 

<table>

<form method="post" action="set.php?tru=<?=$tru?>">

<tr>

<td>



<?=commas($pmp[16])?> Hoes

 <?=$pmp[18]?>% Happy, at

 <input maxlength="7" type="text" class="text" name="pay" size="3" value="<?=$pmp[20]?>">% payout. <input maxlength="7" type="submit" class="button" name="setpay" value="Set">



</td>

</tr>

</form>

</table>

</td>

</tr>

</table>

 Attacks in: <?=$pmp[26]?>  Attacks Out: <?=$pmp[27]?>

 
<?if($pmp[6] < $game[1]){?>
 <?if($turnupdate[0]){?>You will receive <?=$game[0]?> turns in: <?=countup($turnupdate[0]+600)?>
 You can hold up to <?=commas($game[1])?> turns.<?}else{?>Turns will start processing in less then 10 minutes...<?}?>
<? } else { ?>
 You have reached the maximum turns for this round
<?}?>
</td>

</tr>

</table>

<?

GAMEFOOTER();

?>[/code]

trq · January 29, 2007

[quote]i just need to see if its secure[/quote]

That is an extremely objective question.

I can tell you the code is poorly formatted and will be difficult to debug. You also appear to be using variables that I don't see being declared anywhere.

This very first line.....

[code=php:0]$res = mysql_fetch_array(mysql_query("SELECT res FROM $tab[pimp] WHERE id='$id';"));[/code]

Where is $id being declared? Also, before using any variable within an sql query you should sanitize it at very least with [url=http://php.net/mysql_real_escape_string]mysql_real_escape_string[/url]. And please.... nesting functions like that makes your code VERY difficult to debug and prone to errors. You should always check your query actually succeeds before trying to use the result with mysql_fetch_array.

Sign In

Is this script buggy?

Recommended Posts

imhere2009

Link to comment

Share on other sites

Jessica

Link to comment

Share on other sites

imhere2009

Link to comment

Share on other sites

trq

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information