FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
HackMe-SQL-Injection-Challenges/shops.php at master · breakthenet/HackMe-SQL-Injection-Challenges · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
breakthenet
/
HackMe-SQL-Injection-Challenges
Public
Notifications
You must be signed in to change notification settings
Fork
46
Star
414
Code
Issues
0
Pull requests
0
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
HackMe-SQL-Injection-Challenges
/
shops.php
Copy path
More file actions
More file actions
Latest commit
History
History
History
executable file
·
83 lines (82 loc) · 2.93 KB
Breadcrumbs
HackMe-SQL-Injection-Challenges
/
shops.php
Copy path
File metadata and controls
executable file
·
83 lines (82 loc) · 2.93 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
<?php
session_start
();
require
"
global_func.php
"
;
if
(
$
_SESSION
[
'
loggedin
'
] ==
0
)
{
header
(
"
Location: login.php
"
);
exit
;
}
$
userid
=
$
_SESSION
[
'
userid
'
];
require
"
header.php
"
;
$
h
=
new
headers
;
$
h
->
startheaders
();
include
"
mysql.php
"
;
global
$
c
;
$
is
=
mysql_query
(
"
SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=
$
userid
"
,
$
c
)
or
die
(
mysql_error
());
$
ir
=
mysql_fetch_array
(
$
is
);
check_level
();
$
fm
=
money_formatter
(
$
ir
[
'
money
'
]);
$
cm
=
money_formatter
(
$
ir
[
'
crystals
'
],
''
);
$
lv
=
date
(
'
F j, Y, g:i a
'
,
$
ir
[
'
laston
'
]);
$
h
->
userdata
(
$
ir
,
$
lv
,
$
fm
,
$
cm
);
$
h
->
menuarea
();
$
_GET
[
'
shop
'
] =
abs
((
int
)
$
_GET
[
'
shop
'
]);
if
(!
$
_GET
[
'
shop
'
])
{
print
"
You begin looking through town and you see a few shops.<br />
"
;
$
q
=
mysql_query
(
"
SELECT * FROM shops WHERE shopLOCATION=
{
$
ir
[
'
location
'
]}"
,
$
c
);
print
"
<table width=85%><tr style='background: gray;'><th>Shop</th><th>Description</th></tr>
"
;
while
(
$
r
=
mysql_fetch_array
(
$
q
))
{
print
"
<tr><td><a href='shops.php?shop=
{
$
r
[
'
shopID
'
]}
'>
{
$
r
[
'
shopNAME
'
]}
</a></td><td>
{
$
r
[
'
shopDESCRIPTION
'
]}
</td></tr>
"
;
}
print
"
</table>
"
;
}
else
{
$
sd
=
mysql_query
(
"
SELECT * FROM shops WHERE shopID=
{
$
_GET
[
'
shop
'
]}"
,
$
c
);
if
(
mysql_num_rows
(
$
sd
))
{
$
shopdata
=
mysql_fetch_array
(
$
sd
);
if
(
$
shopdata
[
'
shopLOCATION
'
] ==
$
ir
[
'
location
'
])
{
print
"
Browsing items at <b>
{
$
shopdata
[
'
shopNAME
'
]}
...</b><br />
<table><tr style='background: gray;'><th>Item</th><th>Description</th><th>Price</th><th>Sell Price</th><th>Buy</th></tr>
"
;
$
qtwo
=
mysql_query
(
"
SELECT si.*,i.*,it.* FROM shopitems si LEFT JOIN items i ON si.sitemITEMID=i.itmid LEFT JOIN itemtypes it ON i.itmtype=it.itmtypeid WHERE si.sitemSHOP=
{
$
_GET
[
'
shop
'
]}
ORDER BY i.itmtype ASC, i.itmbuyprice ASC, i.itmname ASC
"
,
$
c
)
or
die
(
mysql_error
());
$
lt
=
""
;
while
(
$
r
=
mysql_fetch_array
(
$
qtwo
))
{
if
(
$
lt
!=
$
r
[
'
itmtypename
'
])
{
$
lt
=
$
r
[
'
itmtypename
'
];
print
"\n
<tr style='background: gray;'><th colspan=5>
{
$
lt
}
</th></tr>
"
;
}
print
"\n
<tr><td>
{
$
r
[
'
itmname
'
]}
</td><td>
{
$
r
[
'
itmdesc
'
]}
</td><td>
\${
$
r
[
'
itmbuyprice
'
]}
</td><td>
\${
$
r
[
'
itmsellprice
'
]}
</td><td><form action='itembuy.php?ID=
{
$
r
[
'
itmid
'
]}
' method='post'>Qty: <input type='text' name='qty' value='1' /><input type='submit' value='Buy' /></form></td></tr>
"
;
}
print
"
</table>
"
;
}
else
{
print
"
You are trying to access a shop in another city!
"
;
}
}
else
{
print
"
You are trying to access an invalid shop!
"
;
}
}
$
h
->
endpage
();
Back
|
FazBrowse Home
|
New Git URL