<?php
session_start();
error_reporting(0);
require("data\_dbconfig.php");
function writelog($loguser,$logmsg)
        {
                $logtime = date("Y-m-d G:i");
                $insertlog = mysql_query("INSERT INTO global_log (id, loggeduser, reason, logtime) VALUES ('', '".$loguser."', '".$logmsg."', '".$logtime."')");
        }

                if ($_GET['action'] == 'login')
                {
                        $selected = mssql_select_db('OdinAccount', $mssqlhandle) or die ("Couldn't open database Account");
                        $loginusername = mysql_real_escape_string($_POST['username']);
                        $loginpassword = mysql_real_escape_string($_POST['password']);
                        $get_user = mssql_query("SELECT * FROM tAccounts WHERE (sUsername = '".$loginusername."') AND (sUserPass = '".$loginpassword."')");

                        $row_user = mssql_fetch_array($get_user);
                                if (mssql_num_rows($get_user) > 0)
                                        {
                                                if ($row_user['nAuthID'] < 7)
                                                        {
                                                                $datenrichtig = false;
                                                                $_SESSION['user_eingeloggt'] = false;
                                                                $_SESSION['error'] = "NO ACCESS!!!";

                                                        } else {
                                                  $datenrichtig = true;
                                                $_SESSION['username'] = $row_user["sUsername"];
                                                  $_SESSION['userpass'] = $row_user["sUserPass"];
                                              $_SESSION['last_besuch'] = time();
                                                  $_SESSION['admin_eingeloggt'] = true;
                                                $_SESSION['level'] = $row_user['nAuthID'];
                                                $_SESSION['since'] = $row_user["dDate"];
                                                $_SESSION['userno'] = $row_user["nEMID"];
                                                writelog($_SESSION["username"],"logged in");
                                                header ("Location: index.php");
                                                                        }

                                        }
                    else
                    {
                                                $datenrichtig = false;
                                                  $_SESSION['admin_eingeloggt'] = false;
                                                $_SESSION['error'] = "User not Found!!!";
                                                header ("Location: index.php");
                                        }

                                if ($datenrichtig == true)
                                        {
                                                setcookie("username", "".$_SESSION['username']."", time()+(3600*24*365));
                                                setcookie("userpass", "".$_SESSION['userpass']."", time()+(3600*24*365));
                                                header ("Location: index.php");

                                        }
                                else
                                       {
                                                $_SESSION['error'] = "User not Found!!!";
                                                header ("Location: index.php");
                                        }

                }

                if ($_GET['action'] == 'logout')
                {
                        writelog($_SESSION['username'],"logged out");
                        $_SESSION = array();
                        setcookie("username","",0);
                        setcookie("userpass","",0);
                        setcookie("last_besuch","",0);
                        setcookie("level","",0);
                        header ("Location: index.php");
                }
                if ($_GET['action'] == 'addnews')
                {
                        $datum = date("Y-m-d G:i");
                        $newstext = htmlspecialchars($_POST['newstext']);
                        $newstext = nl2br($newstext);

                        $newnews = mysql_query("INSERT INTO global_news (id, newstopic, newstext, newsposter, newsdate) VALUES ('', '".$_POST['newstopic']."', '".$newstext."', '".$_POST['newsposter']."', '".$datum."')");
                        $_SESSION['done'] = "<font color='green'>News posted!!!</font>";

                        writelog($_SESSION["username"],"posted News");
                        header ("Location: index.php?show=menu_main&content=add_news");

                }
                if ($_GET['action'] == 'enhance')
                {
                        if (isset($_POST['enhancestep2']))
                                {
                                $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                $get_char = mssql_query("SELECT * FROM tCharacter WHERE (sID = '".$_POST['searchchar']."')");
                                        if (mssql_num_rows($get_char) < 1)
                                                {
                                                        $_SESSION['enhancemsg'] = "<font color='red'><strong>User not found!!!!</strong></font>";
                                                        $_SESSION['enhance'] = '5';
                                                        header ("Location: index.php?show=user_menu&content=enhancement");
                                                } else {
                                                        $row_char = mssql_fetch_array($get_char);

                                                        $_SESSION['enhancechars'] = array();
                                                        $_SESSION['enhanceids'] = array();
                                                        $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                                        $get_chars = mssql_query("SELECT * FROM tCharacter WHERE nUserNo = '".$row_char['nUserNo']."' ORDER BY sID DESC");
                                                        while($row_chars = mssql_fetch_array($get_chars))
                                                                {
                                                                        $_SESSION['enhancechars'][] = $row_chars['nCharNo'];
                                                                        $_SESSION['enhanceids'][] = $row_chars['sID'];
                                                                }


                                                        $_SESSION['enhance'] = 2;
                                                        $_SESSION['enhancechar'] = $row_char['sID'];
                                                        $_SESSION['enhancecharid'] = $row_char['nCharNo'];
                                                        header ("Location: index.php?show=user_menu&content=enhancement");
                                                }

                                }
                        if (isset($_POST['enhancestep3']))
                                {
                                        $_SESSION['enhancekey'] = array();
                                        $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                        $get_key = mssql_query("SELECT nItemKey FROM tItem WHERE (nOwner = '".$_POST['characterid']."') AND (nItemID = '".$_POST['itemid']."')");
                                        if (mssql_num_rows($get_key) < 1)
                                                {
                                                        $_SESSION['enhancemsg'] = "<font color='red'><strong>Item not found!!!!</strong></font>";
                                                        $_SESSION['enhance'] = '5';
                                                        header ("Location: index.php?show=user_menu&content=enhancement");
                                                } else {
                                                                while($row_key = mssql_fetch_array($get_key))
                                                                        {
                                                                                $_SESSION['enhancekey'][] = $row_key['nItemKey'];
                                                                        }

                                                                                $_SESSION['enhance'] = 3;

                                                                        header ("Location: index.php?show=user_menu&content=enhancement");
                                                }
                                }

                        if (isset($_POST['enhanceitem']))
                                {
                                        if ($_POST['itemkey'] == '')
                                                {
                                                $_SESSION['enhance'] = '5';
                                                $_SESSION['enhancemsg'] = "<font color='red'><strong>No Item found!!!</strong></font>";
                                                header ("Location: index.php?show=user_menu&content=enhancement");
                                                } else {
                                        $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                        $writeindb = mssql_query("UPDATE tItemOptions SET nOptionData = '".$_POST['itemlevel']."' WHERE (nItemkey = '".$_POST['itemkey']."') AND (nOptionType = '500')");
                                        $writeindb = mssql_query("UPDATE tItemOptions SET nOptionData = '".$_POST['itemlevel']."' WHERE (nItemkey = '".$_POST['itemkey']."') AND (nOptionType = '600')");
                                        $writeindb = mssql_query("UPDATE tItemOptions SET nOptionData = '".$_POST['itemlevel']."' WHERE (nItemkey = '".$_POST['itemkey']."') AND (nOptionType = '700')");
                                        $writeindb = mssql_query("UPDATE tItemOptions SET nOptionData = '".$_POST['itemlevel']."' WHERE (nItemkey = '".$_POST['itemkey']."') AND (nOptionType = '800')");

                                        writelog($_SESSION["username"],"enhanched an Item");

                                        $_SESSION['enhance'] = 4;
                                        $_SESSION['enhancemsg'] = "<font color='#00CC00'><strong>Item Successfully enchanched</strong></font>";

                                        header ("Location: index.php?show=user_menu&content=enhancement");
                                                }

                                }

                }

                if ($_GET['action'] == 'delnews')
                {

                        foreach($_POST['deletenews'] as $var)
                                {
                                        $where .= "'".$var."',";
                                }
                                        $ausgabe = substr($where,0,-1);

                        $sql = "DELETE FROM global_news WHERE id IN (".$ausgabe.")";

                        $result = mysql_query($sql) or die(mysql_error());
                        $_SESSION['delmsg']        = "<font color='#00CC00'><center><strong>marked News successfully deleted!!!</strong></font></center>";
                        writelog($_SESSION["username"],"deleted News");
                        header ("Location: index.php?show=menu_main&content=del_news");


                }

                if ($_GET['action'] == 'changeshopitem')

                {
                 $selected = mssql_select_db('OdinAccount', $mssqlhandle) or die ("Couldn't open database Account");

                         $goodsNo = mysql_real_escape_string($_POST['goodsNo']);
                         $category =  mysql_real_escape_string($_POST['category']);
                         $name =  mysql_real_escape_string($_POST['name']);
                         $imageName = mysql_real_escape_string($_POST['imageName']);
                         $itemType = mysql_real_escape_string($_POST['itemType']);
                         $unit = mysql_real_escape_string($_POST['unit']);
                         $unitDescription = mysql_real_escape_string($_POST['unitDescription']);
                         $price =  mysql_real_escape_string($_POST['price']);
                         $description = mysql_real_escape_string($_POST['description']);
                         $isSell = "False";
                         $inserItem = "INSERT INTO tItem (goodsNo, billingNo, category, groupNo, name, imageName, itemType, unit,unitDescription, price,isSell, description) VALUES ('".$goodsNo."', '".$goodsNo."', '".$category."', '".$goodsNo."', '".$name."', '".$imageName."', '".$itemType."', '".$unit."','".$_SESSION["username"]."', '".$price."', '".$isSell."', '".$description."')";
                         mssql_query($inserItem);

                        $_SESSION['done'] = "<font color='green'>Item updated!!!</font>";
                        if ($_POST['itemType'] == 1)
                                {
                        writelog($_SESSION["username"],"added item to CS");
                                } else {
                        writelog($_SESSION["username"],"removed item from CS");
                        }
                        header ("Location: index.php?show=cashshop_menu&content=add_cashshop");

                }
                if ($_GET['action'] == 'editchar')
                {
                        if (isset($_POST['editcharstep2']))
                                {
                                        $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                        $get_char = mssql_query("SELECT * FROM tCharacter WHERE (sID = '".$_POST['searchchar']."')");
                                        if (mssql_num_rows($get_char) < 1)
                                                {
                                                        $_SESSION['edit_msg'] = "<center><font color = 'red'><strong>User not Found !!!</strong></font></center>";
                                                        $_SESSION['editcharstep'] = 3;
                                                        header ("Location: index.php?show=user_menu&content=edit_char");

                                                } else {
                                                        $row_char = mssql_fetch_array($get_char);

                                                        $_SESSION['editcharstep'] = 2;
                                                        $_SESSION['edit_char'] = $row_char['sID'];
                                                        header ("Location: index.php?show=user_menu&content=edit_char");
                                                }

                                }
                        if (isset($_POST['editchardone']))
                                {
                                /*

                                _POST['char_hp']        46

                                _POST['char_sp']        32
                                _POST['char_exp']        200
                                _POST['char_money']        0
                                */

                                $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                $writeindb = mssql_query("UPDATE tCharacter SET sID = '".$_POST['charname']."', nLevel = '".$_POST['charlevel']."', nFame = '".$_POST['char_fame']."', nStrength = '".$_POST['char_str']."', nConstitute = '".$_POST['char_end']."', nDexterity = '".$_POST['char_dex']."', nIntelligence = '".$_POST['char_int']."', nMentalPower = '".$_POST['char_spr']."', nHP = '".$_POST['char_hp']."', nSP = '".$_POST['char_sp']."', nExp = '".$_POST['char_exp']."', nMoney = '".$_POST['char_money']."' WHERE sID = '".$_POST['char_old']."'");
                                $_SESSION['editcharstep'] = 3;
                                $_SESSION['edit_msg'] = "Character Profile updated!!!";
                                writelog($_SESSION["username"],"edited an Character");
                                header ("Location: index.php?show=user_menu&content=edit_char");
                                }

                }

                if ($_GET['action'] == 'warpchar')
                {
                $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                $get_user = mssql_query("SELECT * FROM tCharacter WHERE sID = '".$_POST['warpchar']."'");
                $get_coords = mysql_query("SELECT * FROM global_warp WHERE Warpname = '".$_POST['warpmap']."'");
                $row_coords = mysql_fetch_array($get_coords);
                $row_user = mssql_fetch_array($get_user);
                $oldzone = $row_user['sLoginZone'];

                $regenX = $row_coords['RegenX'];
                $regenY = $row_coords['RegenY'];


                                if (mssql_num_rows($get_user) < 1)
                                        {
                                                $_SESSION['msg'] = "<center><font color = 'red'><strong>User not Found !!!</strong></font></center>"; // ERROR
                                                header ("Location: index.php?show=user_menu&content=fix_char");
                                        } else {
                                        $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                                        $writeindb = mssql_query("UPDATE tCharacter SET sLoginZone = '".$_POST['warpmap']."', nLoginZoneX = '".$regenX."', nLoginZoneY = '".$regenY."' WHERE sID = '".$_POST['warpchar']."'");
                                        $_SESSION['msg'] = "<center><font color = 'yellow'><strong>Character successfully warped from ".$oldzone." to ".$row_coords['Mapname']."!!!</strong></font></center>";
                                        writelog($_SESSION["username"],"warped an Character");
                                        header ("Location: index.php?show=user_menu&content=fix_char");

                                        }
                }

                if ($_GET['action'] == 'classchange')
                {
                $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                $get_user = mssql_query("SELECT nCharNo FROM tCharacter WHERE sID = '".$_POST['classchangeuser']."'");
                if (mssql_num_rows($get_user) < 1)
                                        {
                                                $_SESSION['msg'] = "<center><font color = 'red'><strong>User not Found !!!</strong></font></center>"; // ERROR
                                                header ("Location: index.php?show=user_menu&content=fix_char");
                                        } else {
                                                $row_user = mssql_fetch_array($get_user);
                                                $writeindb = mssql_query("UPDATE tCharacterShape SET nClass = '".$_POST['classchangeclass']."' WHERE nCharNo = '".$row_user['nCharNo']."'");
                                                $_SESSION['msg'] = "<center><font color = 'yellow'><strong>Classchange successfully on ".$_POST['classchangeuser']."!!!</strong></font></center>";
                                                writelog($_SESSION["username"],"changed Userclass");
                                                header ("Location: index.php?show=user_menu&content=fix_char");
                                        }
                //phpinfo(INFO_VARIABLES);
                }

                if ($_GET['action'] == 'divorce')
                {
                $selected = mssql_select_db('w00_Character', $mssqlhandle) or die ("Couldn't open database Account");
                $get_user = mssql_query("SELECT FROM tMarriage WHERE nCharNo = '".$_POST['divorceuser']."' OR nPartnerCharNo = '".$_POST['divorceuser']."'");
                if (mssql_num_rows($get_user) < 1)
                                        {
                                                $_SESSION['msg'] = "<center><font color = 'red'><strong>User not Found or not Married yet!!!</strong></font></center>"; // ERROR
                                                header ("Location: index.php?show=user_menu&content=fix_char");
                                        } else {
                                                $get_user = mssql_query("DELETE FROM tMarriage WHERE nCharNo = '".$_POST['divorceuser']."' OR nPartnerCharNo = '".$_POST['divorceuser']."'");
                                                $_SESSION['msg'] = "<center><font color = 'yellow'><strong>".$_POST['divorceuser']." successfully divorced!!!</strong></font></center>";
                                                writelog($_SESSION["username"],"divorced an User");
                                                header ("Location: index.php?show=user_menu&content=fix_char");
                                        }
                }
?>