Can anyone tell me how to fix a security hole in this script. It seems that if I have only xxx amount of credits in my account and if i put in any number as example 255.00 credits works fine, but now if i put in 255.00+100000 then those credits ater the + are also added to my account regardless.. Please can anyone help me out here.
<?
if($action == "store_credits"){
switch($act){
case "store":
$ff = f(q("select * from prev where cid='$id'"));
if($ff["prev_number"] != ""){
if($count>$ff["prev_number"])
echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[prev_number] for this campaign.</b></font><br><br><br></center>";
else {
if(e(q("select id from members_credits where user_id='$user[id]'")))
q("insert into members_credits values('0','$user[id]','$count')");
else
q("update members_credits set credits_num=credits_num+$count where user_id='$user[id]'");
q("update prev set prev_number=prev_number-$count where cid='$id'");
}
}
break;
case "add":
$ff = f(q("select * from members_credits where user_id='$user[id]'"));
if($ff["credits_num"] != ""){
if($count > $ff["credits_num"])
echo "<center><font color=CC0000 style='font-size:14px'><b>Invalid value entered! Value must be from 1 to $ff[credits_num].</b></font><br><br><br></center>";
else {
if(e(q("select id from prev where cid='$id'")))
q("insert into prev values('0','$id','$count')");
else
q("update prev set prev_number=prev_number+$count where cid='$id'");
q("update members_credits set credits_num=credits_num-$count where user_id='$user[id]'");
}
}
break;
}
}
$stored_credits = @f(q("select * from members_credits where user_id='$user[id]'"));
$in_campaigns = f(q("select sum(p.prev_number) as su from campaigns c,prev p where c.id=p.cid and c.user_id='$user[id]' and c.status='1' group by c.user_id;"));
$summ = $stored_credits["credits_num"] + $in_campaigns["su"];?>
<table border=0 width=350>
<tr><td><b>Total credits in your profile:</b></td><td><? echo (float)$summ; ?> credits</td></tr>
<tr><td><b>Credits stored:</b></td><td><? echo (float)$stored_credits["credits_num"]; ?> credits</td></tr>
<tr><td><b>Credits in campaigns detailed:</b></td><td><? echo (float)$in_campaigns["su"]; ?> credits</td></tr>
</table>
<?
$r = q("select * from campaigns where user_id='$user[id]' and status='1'");
if(e($r)){
echo "<div align=center><b>You do not have approved campaigns!</b></div>";
} else {
echo "<table border=0 cellspacing=3 cellpadding=3 align=center>";
echo "<tr><td></td><td>Campaign</td><td>Credits</td></tr>";
$i = 1;
while($ff = f($r)){
$credits = f(q("select * from prev where cid='$ff[id]'"));
echo "<tr><td align=center height=24>$i.</td><td><a href=index.php?src=$src&cid=$ff[id]>$ff[title]</a><br><font color=888888> ($ff[url])</td><td>$credits[prev_number]</td>";
echo "<form action='index.php?src=credits_man&action=store_credits&id=$ff[id]' method=post>";
echo "<td><input type=text name=count value='$credits[prev_number]' size=6> <input type=submit value='store' name=act> <input type=submit value='add' name=act></td>";
echo "</form>";
echo "</tr>\n";
$i++;
}
echo "<tr><td> </td></tr>";
echo "<tr><td colspan=3>Total ".($i-1)." campaign(s)</td></tr>";
echo "</table>";
}
?>
