read(); foreach($_GET as $var => $val) { $get[$var] = @stripslashes(trim($val)); $get_safe[$var] = @mysql_escape_string($get[$var]); } foreach($_POST as $var => $val) { $post[$var] = @stripslashes(trim($val)); $post_safe[$var] = @mysql_escape_string($post[$var]); } $user_ip = GetIP(); if (isset($_COOKIE["sess_key"]) && !isset($_SESSION["user"]["id"])) { $GetLogInfo = mysql_query("SELECT user_id from sessions where sess_key = '".addslashes($_COOKIE["sess_key"])."'") or print(mysql_error() . " " . __FILE__ . " #" . __LINE__); if(mysql_num_rows($GetLogInfo) == 1) { $_SESSION["user"]["id"] = mysql_result($GetLogInfo, 0); } @mysql_free_result($GetLogInfo); } if(isset($_SESSION["user"]) || $_SESSION["user"]["id"] != ""){ $loggedin = true; $sess_user_id = $_SESSION["user"]["id"]; $sess_user_status = $_SESSION["user"]["status"]; $CharacterInfo = GetCharacterInfo($sess_user_id); $WeaponInfo = GetWeaponInfo($CharacterInfo); $ArmourInfo = GetArmourInfo($CharacterInfo); $strMod = ceil($CharacterInfo['strength'] / 2); } $population = mysql_query("SELECT COUNT(id) from users WHERE status > 0") or print(mysql_error() . " " . __FILE__ . " #" . __LINE__); $population = mysql_result($population, 0); $online = mysql_query("SELECT COUNT(id) FROM sessions WHERE (UNIX_TIMESTAMP() - last_update) < 7200") or print(mysql_error() . " " . __FILE__ . " #" . __LINE__); $online = mysql_result($online, 0); $page = $_GET["page"]; $page = str_replace("../", "", $page); // no backtracking! $page = str_replace("./", "", $page); // Stop it!! $page = str_replace("/", "", $page); // Im gonna hurt you.. $page = str_replace(substr(strrchr($page,"."),1), "",$page); // remove extention... no page.html or anyhting fruity like .zip if(file_exists("./pages/$page.php")){ if(file_exists("./includes/{$page}_functions.php")){ include("./includes/{$page}_functions.php"); } } if($loggedin){ //get alerts & messages $AQ = mysql_query("SELECT COUNT(id) FROM alerts WHERE receiver_id = '{$CharacterInfo['id']}' AND seen = '0'") or print(mysql_error() . " " . __FILE__ . " #" . __LINE__); if(mysql_result($AQ, 0) > 0){ $Alert = true; } $MQ = mysql_query("SELECT COUNT(id) FROM messages WHERE receiver_id = '{$CharacterInfo['id']}' AND seen = '0'") or print(mysql_error() . " " . __FILE__ . " #" . __LINE__); if(mysql_result($MQ, 0) > 0){ $Message = true; } } ?> Welcome to Kingsleyville \n"; } ?>

Kingsleyville

KST
Home
Hello, !
Weapon: Armour:
Hit Points: Level:
Exp: Money: KD
Logout

Welcome, Guest

Register
Login

"; $training = true; } else { // training is finished # calculate result of training $min = floor($CharacterInfo['level'] * 150); $max = $min * 2; $xp = mt_rand($min, $max); print "You gained " . format($xp) . " exp from your training.
"; addExp($CharacterInfo['id'], $xp); mysql_query("DELETE FROM training WHERE id = '" . mysql_result($sqlTraining, 0, 'id') . "'"); alert($CharacterInfo['id'], "Training", "You gained " . format($xp) . " exp from your training!"); } } } if($banned){ print "I'm sorry, it appears you've been banned :)"; } else { if(!$training) { if($Alert == true){ print "

You have $AN new Alert(s)


"; } if($Message == true){ print "

You have $MN new message(s)


"; } //check for death :) if($loggedin && $CharacterInfo["now_hp"] == 0 && $page != "hospital"){ $charge = ($CharacterInfo["level"]*50) * ($CharacterInfo["max_hp"] - $CharacterInfo["now_hp"]); $blah = FineMoney($charge,true); print "You were rushed to hospital and you were saved. However you were not covered by insurance, and it cost you $charge KD
"; } // Random things if(mt_rand(1, 200) <= 1) { // 0.5% chance to get some EXP. if($loggedin) { addExp($CharacterInfo['id'], mt_rand(1, 5)); } } if(mt_rand(1, 200) <= 1) { // 0.5% chance to find some money if($loggedin) { $money = mt_rand(1, $CharacterInfo['level'] * 100); updateCharacter("money", "(money + {$money})", $CharacterInfo['id']); print "You found " . format($money) . " KD!"; } } // Load actual page files if(file_exists("./pages/$page.php")){ include("./pages/$page.php"); } else { include("./pages/home.php"); } } } ?>