[Release] WebShop Credits For Resets

<center>
<font color="#FFFFFF">
<?php
if ($_SESSION['user'] == true)
{
    $user = $_SESSION['user'];
    include "securefunction.php";
    include "conreal.php";
    if ($_POST['click'])
    {
        $username = trim(htmlspecialchars($_POST['username']));
        $restarts = trim(htmlspecialchars($_POST['restarts']));
        if (id_check($username) && num($restarts))
        {
            $select = mssql_query("SELECT * FROM character where Name='$username'");
            $broi = mssql_num_rows($select);
            $ifonline = mssql_num_rows(mssql_query("SELECT * from MEMB_STAT where ConnectStat='0' and memb___id='$user'"));
            if ($ifonline > 0)
            {
                if ($broi > "0")
                {
                    $a = mssql_fetch_array($select);
                    $account = $a['AccountID'];
                    if ($account == "$user")
                    {
                        $resets = $a['Resets'];
                        if ($resets < $restarts)
                        {
                            echo "Нямаш достатъчно ресове. Искаш да обмениш $restarts ама имаш само $resets!";
                        }
                        else
                        {
                            if ($restarts == "0")
                            {
                                echo "Не можеш да обменяш 0 реса...";
                            }
                            else
                            {
                                if ($resets == "0")
                                {
                                    echo "Нямаш ресове.";
                                }
                                else
                                {
                                    $givecredit = $restarts * 50;
                                    $update = mssql_query("UPDATE MEMB_CREDITS set credits=credits+$givecredit WHERE memb___id='$user'");
                                    $update = mssql_query("UPDATE Character set Resets=Resets-$restarts WHERE name='$username'");
                                    echo "You successful add $givecredit credits in webshop.<br> Now you are with $restarts smaller then before!";
                                }
                            }
                        }
                    }
                    else
                    {
                        echo "Героят не е твой!";
                    }
                }
                else
                {
                    echo "Няма такъв герой!";
                }
            }
            else
            {
                echo "Логнат сте в играта моля излезте!";
            }
        }
        else
        {
            echo "Забранени символи!<br> В полето \"Characeter\" можете да използвате само от a-z.<br> В полето restarts можете да използвате само от \"0-9\".";
        }


    }
    else
    {
?>
<table width="370" border="0" align="center" cellpadding="0" cellspacing="0">
<form action="" method="post">
  <tr>
    <td colspan="2"><center><font color="#FFFFFF">Тази функция ви позволява да замените restart срещу 50 кредита в <a href="webshop/">webshop</a></font></center></td>
  </tr>
  <tr>
    <td width="153">Герои</td>
    <td width="153">
	<select name="username">
	<?php
	$sel=mssql_query("SELECT * from character where AccountID='$user'");
	while($s=mssql_fetch_array($sel))
	$neim=$s['Name'];
	echo "<option value='$neim'>$neim</option>";
	?>
	</select></td>
  </tr>
  <tr>
    <td>Ресове за обмен</td>
    <td><input type="text" name="restarts"></td>
  </tr>
  <tr>
    <td colspan="2"><input type="submit" name="click" value="Цък" class="buton1"></td>
    </tr>
  </form>
</table>
<?php
    }
}
else
{
    echo "Тази страница е само за регистрирани потребители!";
}
?>
</font>
</center>

<?php
function id_check($var)
{
    if (eregi('^[a-z]+$',$var))
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}
function num($var)
{
    if (eregi('^[0-9]+$',$var))
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}
?>

<?php
$conn=mssql_connect('localhost','sa','pass'); 
$selected=mssql_select_db('MuOnline', $conn);
?>