/halloffame.php

https://github.com/breakthenet/HackMe-SQL-Injection-Challenges · PHP · 334 lines · 324 code · 10 blank · 0 comment · 39 complexity · 70c36eed7bbdcdd50dd1ace6319802e8 MD5 · raw file

  1. <?php
  2. session_start();
  3. require "global_func.php";
  4. if ($_SESSION['loggedin'] == 0)
  5. {
  6. header("Location: login.php");
  7. exit;
  8. }
  9. $userid = $_SESSION['userid'];
  10. require "header.php";
  11. $h = new headers;
  12. $h->startheaders();
  13. include "mysql.php";
  14. global $c;
  15. $is =
  16. mysql_query(
  17. "SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",
  18. $c) or die(mysql_error());
  19. $ir = mysql_fetch_array($is);
  20. check_level();
  21. $fm = money_formatter($ir['money']);
  22. $cm = money_formatter($ir['crystals'], '');
  23. $lv = date('F j, Y, g:i a', $ir['laston']);
  24. $h->userdata($ir, $lv, $fm, $cm);
  25. $h->menuarea();
  26. print
  27. "<h3>Hall Of Fame</h3>
  28. <table width=75%> <tr> <td><a href='halloffame.php?action=level'>LEVEL</a></td> <td><a href='halloffame.php?action=money'>MONEY</a></td> <td><a href='halloffame.php?action=crystals'>CRYSTALS</a></td> <td><a href='halloffame.php?action=total'>TOTAL STATS</a></td> </tr>
  29. <tr> <td><a href='halloffame.php?action=strength'>STRENGTH</a></td> <td><a href='halloffame.php?action=agility'>AGILITY</a></td> <td><a href='halloffame.php?action=guard'>GUARD</a></td> <td><a href='halloffame.php?action=labour'>LABOUR</a></td> <td><a href='halloffame.php?action=iq'>IQ</a></td> </tr> </table>";
  30. switch ($_GET['action'])
  31. {
  32. case "level":
  33. hof_level();
  34. break;
  35. case "money":
  36. hof_money();
  37. break;
  38. case "crystals":
  39. hof_crystals();
  40. break;
  41. case "total":
  42. hof_total();
  43. break;
  44. case "strength":
  45. hof_strength();
  46. break;
  47. case "agility":
  48. hof_agility();
  49. break;
  50. case "guard":
  51. hof_guard();
  52. break;
  53. case "labour":
  54. hof_labour();
  55. break;
  56. case "iq":
  57. hof_iq();
  58. break;
  59. }
  60. function hof_level()
  61. {
  62. global $ir, $c, $userid;
  63. print
  64. "Showing the 20 users with the highest levels<br />
  65. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> <th>Level</th> </tr>";
  66. $q =
  67. mysql_query(
  68. "SELECT u.* FROM users u WHERE u.user_level != 0 ORDER BY level DESC,userid ASC LIMIT 20",
  69. $c);
  70. $p = 0;
  71. while ($r = mysql_fetch_array($q))
  72. {
  73. $p++;
  74. if ($r['userid'] == $userid)
  75. {
  76. $t = "<b>";
  77. $et = "</b>";
  78. }
  79. else
  80. {
  81. $t = "";
  82. $et = "";
  83. }
  84. print
  85. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> <td>$t{$r['level']}$et</td> </tr>";
  86. }
  87. print "</table>";
  88. }
  89. function hof_money()
  90. {
  91. global $ir, $c, $userid;
  92. print
  93. "Showing the 20 users with the highest amount of money<br />
  94. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> <th>Money</th> </tr>";
  95. $q =
  96. mysql_query(
  97. "SELECT u.* FROM users u WHERE u.user_level != 0 ORDER BY money DESC,userid ASC LIMIT 20",
  98. $c);
  99. $p = 0;
  100. while ($r = mysql_fetch_array($q))
  101. {
  102. $p++;
  103. if ($r['userid'] == $userid)
  104. {
  105. $t = "<b>";
  106. $et = "</b>";
  107. }
  108. else
  109. {
  110. $t = "";
  111. $et = "";
  112. }
  113. print
  114. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> <td>$t\$"
  115. . money_formatter($r['money'], '') . "$et</td> </tr>";
  116. }
  117. print "</table>";
  118. }
  119. function hof_crystals()
  120. {
  121. global $ir, $c, $userid;
  122. print
  123. "Showing the 20 users with the highest amount of crystals<br />
  124. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> <th>Crystals</th> </tr>";
  125. $q =
  126. mysql_query(
  127. "SELECT u.* FROM users u WHERE u.user_level != 0 ORDER BY crystals DESC,userid ASC LIMIT 20",
  128. $c);
  129. $p = 0;
  130. while ($r = mysql_fetch_array($q))
  131. {
  132. $p++;
  133. if ($r['userid'] == $userid)
  134. {
  135. $t = "<b>";
  136. $et = "</b>";
  137. }
  138. else
  139. {
  140. $t = "";
  141. $et = "";
  142. }
  143. print
  144. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> <td>$t"
  145. . money_formatter($r['crystals'], '')
  146. . "$et</td> </tr>";
  147. }
  148. print "</table>";
  149. }
  150. function hof_total()
  151. {
  152. global $ir, $c, $userid;
  153. print
  154. "Showing the 20 users with the highest total stats<br />
  155. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  156. $q =
  157. mysql_query(
  158. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY (us.strength+us.agility+us.guard+us.labour+us.IQ) DESC,u.userid ASC LIMIT 20",
  159. $c);
  160. $p = 0;
  161. while ($r = mysql_fetch_array($q))
  162. {
  163. $p++;
  164. if ($r['userid'] == $ir['userid'])
  165. {
  166. $t = "<b>";
  167. $et = "</b>";
  168. }
  169. else
  170. {
  171. $t = "";
  172. $et = "";
  173. }
  174. print
  175. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  176. }
  177. print "</table>";
  178. }
  179. function hof_strength()
  180. {
  181. global $ir, $c, $userid;
  182. print
  183. "Showing the 20 users with the highest strength<br />
  184. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  185. $q =
  186. mysql_query(
  187. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY us.strength DESC,u.userid ASC LIMIT 20",
  188. $c);
  189. $p = 0;
  190. while ($r = mysql_fetch_array($q))
  191. {
  192. $p++;
  193. if ($r['userid'] == $ir['userid'])
  194. {
  195. $t = "<b>";
  196. $et = "</b>";
  197. }
  198. else
  199. {
  200. $t = "";
  201. $et = "";
  202. }
  203. print
  204. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  205. }
  206. print "</table>";
  207. }
  208. function hof_agility()
  209. {
  210. global $ir, $c, $userid;
  211. print
  212. "Showing the 20 users with the highest agility<br />
  213. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  214. $q =
  215. mysql_query(
  216. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY us.agility DESC,u.userid ASC LIMIT 20",
  217. $c);
  218. $p = 0;
  219. while ($r = mysql_fetch_array($q))
  220. {
  221. $p++;
  222. if ($r['userid'] == $ir['userid'])
  223. {
  224. $t = "<b>";
  225. $et = "</b>";
  226. }
  227. else
  228. {
  229. $t = "";
  230. $et = "";
  231. }
  232. print
  233. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  234. }
  235. print "</table>";
  236. }
  237. function hof_guard()
  238. {
  239. global $ir, $c, $userid;
  240. print
  241. "Showing the 20 users with the highest guard<br />
  242. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  243. $q =
  244. mysql_query(
  245. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY us.guard DESC,u.userid ASC LIMIT 20",
  246. $c);
  247. $p = 0;
  248. while ($r = mysql_fetch_array($q))
  249. {
  250. $p++;
  251. if ($r['userid'] == $ir['userid'])
  252. {
  253. $t = "<b>";
  254. $et = "</b>";
  255. }
  256. else
  257. {
  258. $t = "";
  259. $et = "";
  260. }
  261. print
  262. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  263. }
  264. print "</table>";
  265. }
  266. function hof_labour()
  267. {
  268. global $ir, $c, $userid;
  269. print
  270. "Showing the 20 users with the highest labour<br />
  271. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  272. $q =
  273. mysql_query(
  274. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY us.labour DESC,u.userid ASC LIMIT 20",
  275. $c);
  276. $p = 0;
  277. while ($r = mysql_fetch_array($q))
  278. {
  279. $p++;
  280. if ($r['userid'] == $ir['userid'])
  281. {
  282. $t = "<b>";
  283. $et = "</b>";
  284. }
  285. else
  286. {
  287. $t = "";
  288. $et = "";
  289. }
  290. print
  291. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  292. }
  293. print "</table>";
  294. }
  295. function hof_iq()
  296. {
  297. global $ir, $c, $userid;
  298. print
  299. "Showing the 20 users with the highest IQ<br />
  300. <table width=75%><tr style='background:gray'> <th>Pos</th> <th>User</th> </tr>";
  301. $q =
  302. mysql_query(
  303. "SELECT u.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.user_level != 0 ORDER BY us.IQ DESC,u.userid ASC LIMIT 20",
  304. $c);
  305. $p = 0;
  306. while ($r = mysql_fetch_array($q))
  307. {
  308. $p++;
  309. if ($r['userid'] == $ir['userid'])
  310. {
  311. $t = "<b>";
  312. $et = "</b>";
  313. }
  314. else
  315. {
  316. $t = "";
  317. $et = "";
  318. }
  319. print
  320. "<tr> <td>$t$p$et</td> <td>$t{$r['username']} [{$r['userid']}]$et</td> </tr>";
  321. }
  322. print "</table>";
  323. }
  324. $h->endpage();