[Release][PHP]Lucky Box

<h1>Lucky Box</h1>
<p>
<?php
//Script by Canic 2012
if ( $__TOKEN == 'xxxx' )
{
	if($_SESSION['logged_in'] == '') 
	{
		showMessage( 'info', 'Session terminated!' );
	}else{
		if ( $_POST['Get'] )
		{
			$mssql_link = mssql_connect( $xx, $xx, $xx );
			if ( !$mssql_link )
			{
				showMessage( 'info', 'Registration is temporarly offline' );
			}
			else
			{
				$orderNumber	= mssql_escape_string( $_POST['orderNumber'] );
				$insertItem = mssql_query( "INSERT INTO Account..tChargeItem(orderNo, userNo, goodsNo) VALUES(CAST(RAND() * 1000000 AS INT), '".$_SESSION['userID']."', '$orderNumber');" );
				showMessage( 'success', 'The Item is now in your Cashshop Inventory!', 2, 'index.php?module=news');
			}
		}
		else if ( $_POST['Submit'] )
		{
			$mssql_link = mssql_connect( $xx, $xx, $xx );
			$AccountCoins = mssql_query("SELECT * FROM Account..tUser WHERE nUserNo = '".$_SESSION['userID']."' AND nNCoin >= '2';");
			$accountFetch = mssql_fetch_array($AccountCoins);
			if (mssql_num_rows($AccountCoins) == 1)
			{
				mssql_query("UPDATE Account..tUser SET nNCoin = nNCoin - '2' WHERE nUserNo = '".$_SESSION['userID']."';");
				$count2 = mssql_query("SELECT * FROM Account..tNanOBox");
				$count = mssql_num_rows($count2);
				$randome = mt_rand(1, $count);
				if ($randome >= 8)
				{
					$randome2 = mt_rand(0, 7);
					$randome = $randome - $randome2;
					$selectedItem = mssql_query("SELECT * FROM Account..tNanOBox WHERE No = '$randome';");
					$item = mssql_fetch_array($selectedItem);
					showMessage( 'success', '<center>You have earned: '.$item['description'].'<br /> <br /> <img src="http://www.elitepvpers.com/forum/images/mall/'.$item['img'].'.jpg" /><br /><form method="post"><input type="hidden" name="orderNumber" value="'.$item['goodsNo'].'" /><input type="submit" name="Get" value="Get the Item" /></form><br /><br /><a href="index.php?module=NaNLucky">Lucky Box</a></center>' );						
				}
				else
				{
					$selectedItem = mssql_query("SELECT * FROM Account..tNanOBox WHERE No = '$randome';");
					$item = mssql_fetch_array($selectedItem);
					showMessage( 'success', '<center>You have earned: '.$item['description'].'<br /> <br /> <img src="http://www.elitepvpers.com/forum/images/mall/'.$item['img'].'.jpg" /><br /><form method="post"><input type="hidden" name="orderNumber" value="'.$item['goodsNo'].'" /><input type="submit" name="Get" value="Get the Item" /></form><br /><br /><a href="index.php?module=NaNLucky">Lucky Box</a></center>' );						
				}
			}
			else
			{
				showMessage( 'error', 'Sorry :( You can play with a minimum of 2 NanO Coins!' );
			}	
		}
		else
		{
			?>
			Welcome to our Lucky Box! One round = 2 NanO Coins! Currently you have <?php $AccountCoins = mssql_query("SELECT * FROM Account..tUser WHERE nUserNo = '".$_SESSION['userID']."';"); $accountFetch = mssql_fetch_array($AccountCoins); echo $accountFetch['nNCoin'].' NanO Coins' ; ?>
			<br />
			<br />
			<form method="post">
			<table width="400px">
				<tr>
					<td>
					Good Luck :)
					</td>
					<td><input type="submit" name="Submit" value="Submit" /></td>
				</tr>
			</table>
			</form>
			<?php
		}
	}
}
?>