Hello , I recently bought a Facebook app form a person on digital point and I just found out the bank.php file has an error in it, I don't know where but when you put a - in front of a withdrawal amount it will give you the amount of money no mater what amount of money you have in the bank, kind of like the mafia wars glitch, i have pasted the bank.php code bellow if someone will look at it and trey to help me I would appreciate it.

<?php

require_once 'top.php';

?>

<div class=mainback>

<div class=middlebox>

<P><a href=<?php echo $appCanvasUrl; ?>>[Back to Main Menu]</a></P>
<BR>

<?php

if( isset($_POST[submitB]) || isset($_POST[submitD]) || isset($_POST[submitW])) {
	echo $status;
}

?>

<P class=veryBigWhiteP>The Bank</P>

<P>Open a bank account with the minimum balance seen below. A 10% safehouse fee will be taken out of all incoming funds. Once your account is opened, you must maintain a minimum balance of $2000. Money kept in the bank cannot be stolen by other gangsters.</P>
<BR>

<?php

	$res = query("SELECT COUNT(*) FROM `cu_bank` WHERE `userid`=$user");
	list($total_row) = mysql_fetch_array($res);

	if( $total_row > 0 ) {
		$res = query("SELECT * FROM `cu_bank` WHERE `userid`=$user");
		while( $row = mysql_fetch_array($res) ) {
			echo '<P class=titleP>Your balance: '. number_format($row[bamount],2) .'</P><BR>';
		}

		echo '<form action=bank.php method=POST>';
		echo '<P>Deposit: <input type=text name=damount size=20 value=0>&nbsp;&nbsp;<input type=submit name=submitD value="Deposit"></P>';
		echo '</form>';
		echo '<BR>';
		echo '<form action=bank.php method=POST>';
		echo '<P>Withdraw: <input type=text name=wamount size=20 value=0>&nbsp;&nbsp;<input type=submit name=submitW value="Withdraw"></P>';
		echo '</form>';

	}
	else {
		echo '<form action=bank.php method=POST>';
		echo '<P>Initial Balance: <input type=text name=amount size=20 value=10000>&nbsp;&nbsp;<input type=submit name=submitB value="Open Account"></P>';
		echo '</form>';
	}
	

?>

<BR>

</div>

</div>

I don't think the problem is with this page. The form handler is the problem. It needs to check whether the balance - withdrawal is less than 2000. If so send an error, else process.

You could tidy up the page with a conditional statement to hide the withdraw form and replace it with something like 'Insufficient funds to make a withrawal' if the balance is less than 2001, e.g.

if(number_format($row[bamount],2) < 2001){
   echo "<p>Insufficient funds...</p>
}else{
  ... (show withdrawal form) ...
}

Some javascript could be used for client-side validation on the withrawal form to check that balance-withrawal < 2000.

[You'll need to introduce 'id' attributes to your input tags, e.g. id="wamount" and form tags, e.g. id='withdrawform']

function checkBalance(balance){
   var myB = balance;
   var wDL = document.getElementById('wamount').value;
//validation should check to ensure that it is a number

   if(myB - wDL < 2000){
      document.getElementById('bmsg').text = 'Insufficient funds...';
   }else{
      document.getElementById('withdrawform').submit;
   }

}

Apply this to the onclick event of the withrawal submit button:

<input type=submit name=submitW value="Withdraw" onclick="checkBalance(<?php echo number_format($row[bamount],2);?>);return false;" />

I've typed this really quickly off the top of my head - it's not tested. The js may need a bit of work.

if( isset($_POST[submitB]) ) {
	if( $_POST[amount] >= 10000 ) {
		$user_cash = get_cash($user);
		if( $_POST[amount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot deposit more money than your current cash!<BR>Please try again later...</P><BR></div>';
		else {
			$res = query("INSERT INTO `cu_bank` (`userid`, `bamount`) VALUES ( $user, $_POST[amount])");
			$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`-$_POST[amount]) WHERE `userid`=$user");
			if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>You successfully opened a bank account!</P><BR></div>'; }
			else $status = '<div class=noticeBox><P class=redNoticeP>There was an error while opening your bank account!<BR>Please try again later...</P><BR></div>';
		}
	}
	else $status = '<div class=noticeBox><P class=redNoticeP>You need $10,000 initial balance to open a new bank account!</P><BR></div>';
}

if( isset($_POST[submitD]) ) {

	$user_cash = get_cash($user);
	if( $_POST[damount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot deposit more money than your current cash!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`+$_POST[damount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`-$_POST[damount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Deposit was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error while depositing your amount!<BR>Please try again later...</P><BR></div>';
	}
}

if( isset($_POST[submitW]) ) {

	$user_cash = get_bank_cash($user);
	if( $_POST[wamount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot withdraw more than your bank balance!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`-$_POST[wamount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`+$_POST[wamount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Withdraw was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error in withdrawal process!<BR>Please try again later...</P><BR></div>';
	}
}

I just found this code in the top.php I don;t know if this is what is causing the problem but can someone see if they can find errors? Thanks!

Well, this is the bit that reacts to the withdrawal form:

if( isset($_POST[submitW]) ) {

	$user_cash = get_bank_cash($user);
	if( $_POST[wamount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot withdraw more than your bank balance!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`-$_POST[wamount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`+$_POST[wamount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Withdraw was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error in withdrawal process!<BR>Please try again later...</P><BR></div>';
	}
}

Did you say you BOUGHT this script?? This is seriously bad.

The whole thing stinks. There are no id attributes in the HTML tags - the name attributes values do not have quotes around them. The pHp variables (e.g. $_POST[submitW]) are not written properly (should be $_POST) etc. HTML tags are all uppercase... I could go on.

If I were you, I'd write my own. This app is dead simple to create and if you did spend money on it, ask for a refund as it doesn't work.

This article has been dead for over six months. Start a new discussion instead.