Again, the one released on epvp is incomplete and has a security flaw. Fix the script D:<
Just because it is a release doesn't mean its perfect. We are all human and we all make mistakes or simple errors.
If you are using ODBC;
Code:
<?php
function mssql_escape_string($data)
{
if (!isset($data) or empty($data))
return '';
if (is_numeric($data))
return $data;
$non_displayables = array('/%0[0-8bcef]/', // url encoded 00-08, 11, 12, 14, 15
'/%1[0-9a-f]/', // url encoded 16-31
'/[\x00-\x08]/', // 00-08
'/\x0b/', // 11
'/\x0c/', // 12
'/[\x0e-\x1f]/'); // 14-31
foreach ($non_displayables as $regex)
$data = preg_replace($regex, '', $data);
$data = str_replace("'", "''", $data);
return $data;
}
$host = '127.0.0.1';
$dbuser = 'Your Login';
$dbpass = 'Your Password';
$class = array(0 => 'Warrior', 1 => 'Guardian', 2 => 'Assasin', 3 => 'Hunter', 4 => 'Pagan', 5 => 'Oracle', 6 => 'Fighter', 7 => 'Defender', 8 => 'Ranger', 9 => 'Archer', 10 => 'Mage', 11 => 'Priest');
$conn = @odbc_connect("Driver={SQL Server};Server=$host;", $dbuser, $dbpass) or die("Database Connection Error!");
$UserID = isset($_POST['username']) ? mssql_escape_string(trim($_POST['username'])) : '';
$Pass = isset($_POST['password']) ? mssql_escape_string(trim($_POST['password'])) : '';
$Char = isset($_POST['char']) ? mssql_escape_string(trim($_POST['char'])) : '';
if (isset($_POST['submit'])) {
if (strlen($UserID) < 1)
die("User Name too short");
if (strlen($Pass) < 1)
die("Password too short.");
$res = odbc_exec($conn, "SELECT * FROM [PS_UserData].[dbo].[Users_Master] WHERE UserID = '" . $UserID . "' AND Pw = '" . $Pass . "'");
if (odbc_num_rows($res) == 0) {
die("Username/Password is incorrect");
} else {
$res2 = odbc_exec($conn,"SELECT umg.Country, c.Family, c.CharName, c.CharID, c.Job, c.Level
FROM [PS_GameData].[dbo].[UserMaxGrow] AS umg
INNER JOIN [PS_GameData].[dbo].[Chars] AS c ON umg.UserUID = c.UserUID
WHERE c.UserID = '" . $UserID . "' AND c.Del=1");
if (odbc_num_rows($res2) == 0) {
echo "<font color=#FFFFFF>Account does not contain any dead characters.";
} else {
echo "<form action=\"" . $_SERVER['PHP_SELF'] . "\" method=\"POST\"><font color=#FFFFFF>Select toon to resurrect :<br />
<input type=\"hidden\" name=\"username\" value=\"" . $UserID . "\">
<table cellspacing=4 cellpadding=5 border=2 style=\"border-style:white;\"><body bgcolor=4D101F>
<tr><td><font color=#FFFFFF>Select</td><td><font color=#FFFFFF>CharName</td><td><font color=#FFFFFF>Class</td><td><font color=#FFFFFF>Level</td></tr>";
while ($chars = odbc_fetch_array($res2)) {
if ($chars['Country'] == 0) {
if ($chars['Family'] == 0 || $chars['Family'] == 1) {
echo "<tr>";
echo "<td><font color=white><input type=\"radio\" name =\"char\" value=\"" . $chars['CharName'] . "," . $chars['CharID'] . "\"></font></td>";
echo "<td><font color=white>" . $chars['CharName'] . "</font></td><td><font color=white>" . $class[$chars['Job'] + 6] . "</font></td>";
echo "<td><font color=white>" . $chars['Level'] . "</font></td>";
echo "</tr>";
}
} elseif ($chars['Country'] == 1) {
if ($chars['Family'] == 2 || $chars['Family'] == 3) {
echo "<tr><font color=#FFFFFF>";
echo "<td><FONT COLOR=WHITE><input type=\"radio\" name =\"char\" value=\"" . $chars['CharName'] . "," . $chars['CharID'] . "\"></font></td>";
echo "<td><font color=white>" . $chars['CharName'] . "</font></td><td><font color=white>" . $class[$chars['Job']] . "</font></td>";
echo "<td><font color=white>" . $chars['Level'] . "</font></td>";
echo "</tr>";
}
}
}
echo "</table><input type=\"submit\" value=\"Submit\" name=\"submit2\" /></form>";
}
}
} elseif (isset($_POST['submit2'])) {
$slot = -1;
$res1 = odbc_exec($conn, "
SELECT MIN(Slots.Slot) AS OpenSlot FROM
(SELECT 0 AS Slot UNION SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 4) AS Slots
LEFT JOIN
(SELECT c.Slot
FROM PS_UserData.dbo.Users_Master AS um
INNER JOIN PS_GameData.dbo.Chars AS c ON c.UserUID = um.UserUID
WHERE um.UserID = '" . $UserID . "'
AND c.Del = 0) AS Chars ON Chars.Slot = Slots.Slot
WHERE Chars.Slot IS NULL");
$slot = odbc_fetch_array($res1);
$toon2 = explode(',', $Char);
$charID = mssql_escape_string($toon2[1]);
$openSlot = mssql_escape_string($slot['OpenSlot']);
if ($slot['OpenSlot'] > -1 && $slot['OpenSlot'] < 5) {
odbc_exec($conn, "UPDATE PS_GameData.dbo.Chars SET Del=0, Slot={$openSlot}, Map=42, PosX=63 , PosZ=57, DeleteDate=NULL WHERE CharID = {$charID}");
echo "<body bgcolor=4D101F><font color=white>Successfully resurrected <br /> Login = " . $UserID . "<br />Slot = " . ($slot['OpenSlot'] + 1) . "<br />Char = $toon2[0]</font>";
} else
echo "<body bgcolor=4D101F><font color=white>No slots avaliable</font>";
} else {
?>
<html>
<head>
<title>Character Ressurection</title></head>
<body bgcolor=4D101F>
<form action="<?php
echo $_SERVER['PHP_SELF'];
?>" method="POST">
<fieldset style="font:100% trebuchet ms;width:0px;">
<legend ><font color=white>Resurrection Form </font></legend>
<font face="Trebuchet MS">
<table>
<tr>
<font size=1><font color=white><i>*Toon will be resurrected in an avaliable free slot.</i></font>
</tr>
<tr>
<td><font color=white>Account Login:</td><td> <input type="text" name="username" maxlength=20/></td>
</tr>
<tr>
<td><font color=white>Account Password:</td><td><input type="password" name="password" maxlength=20/></td>
</tr>
</font>
</table>
<input type="submit" value="Submit" name="submit" />
</fieldset>
</form>
</body>
</html>
<?php
}
?>
This is the security fix to prevent SQL Injection. *No 100% guarantee this is perfect but it can't be worse than what you are using now.*
Credits go to Tnelis for the ODBC version rewrite and Abrasive for fixing the security flaw.
So tell the haters to shove it ^_~
Karma
