Habe den von Kroya.. Die shop.php sieht so aus:
Quote:
<?php
if(isset($_SESSION['account'])) {
if(!empty($_GET['kat'])) {
if(!empty($_GET['buy'])) {
?>
<div style="padding: 10px; margin:10px;" class="fui">
<p style="margin:7px 0px; background:url(images/ui/fui.png); -moz-border-radius:5px; padding:5px; ">
<b><font color="#990000">Item Kaufen</font></b></p>
<?php
$login = $_SESSION['account'];
$checkuser = mysql_query("SELECT * FROM account.account WHERE login = '$login'");
$array = mysql_fetch_array($checkuser);
$itemid = $_GET['buy'];
$user = $_SESSION['account'];
$coins = $array['coins'];
$query = mysql_query("SELECT * FROM account.is_items WHERE value = '$itemid'");
$array2 = mysql_fetch_array($query);
$rescash = $coins-$array2['preis'];
$posQr = mysql_query("SELECT * FROM player.item WHERE owner_id = ".$array['id']." AND window = 'MALL' ORDER BY pos DESC LIMIT 1");
while($pos1 = mysql_fetch_object($posQr)){
if ($pos1->pos == '42'){
$pos = '1';
} else {
$pos = $pos1->pos + 1;
}
}
if($rescash > 0) {
$i = 0;
$giveitem = "INSERT INTO player.item SET
owner_id = ".$array['id'].", window = 'MALL', pos = '$pos',
count = '1', vnum = '$itemid', socket0 = '1', socket1 = '1', socket2 = '1'";
$re = mysql_query($giveitem);
if($re) {
$cashresult = $coins-$array2['preis'];
$coins = "UPDATE account.account SET coins = coins-'".$array2['preis']."' WHERE login = '$login'";
$coinsresult = mysql_query($coins);
if($coinsresult) {
echo '
Du hast erfolgreich ein/e '.$array2['item_name'].' gekauft!';
} else { echo "Kaufen fehlgeschlagen."; }
} else { echo "Deine Coins genügen nicht."; }
} else { echo "Kaufen fehlgeschlagen."; }
?>
</div>
<?php
}
?>
<?php
$cat = "SELECT * FROM account.is_items WHERE kat = ".$_GET['kat']."";
$catQry = mysql_query($cat);
while($row2 = mysql_fetch_object($catQry)) {
$size = GetImageSize ("images/is_img/".$row2->value.".png");
echo '<div style="padding: 10px; margin:10px;" class="fui"><table width="100%" border="0">
<td width="10%">
<img src="images/is_img/'.$row2->value.'.png" width="'.$size[0].'" height="'.$size[1].'" />
</td>
<td width="70%">
<p style="font-size:9px; background:url(images/ui/fui.png); -moz-border-radius:5px; padding:5px; ">
<b>'.$row2->item_name.'</b></p><br>
'.$row2->item_info.'
</td>
<td width="3%">
</td>
<td width="30%">
Preis: '.$row2->preis.' coins<br>
(<a href="index.php?src=shop&kat='.$_GET['kat'].'&buy='.$row2->value.'">Item Kaufen</a>)
</td>
</table>
</div>
';
}
} else {
include('function/home.php');
}
} else {
echo 'Du musst dich Einloggen um diese Funktionen zu nutzen';
}
?>
|
Sobald man aber im Link die ID verändert, kann man kaufen was man möchte. Also die Item-ID, werden auch keine Coins abgezogen..
