Hello , I recently bought a Facebook app form a person on digital point and I just found out the bank.php file has an error in it, I don't know where but when you put a - in front of a withdrawal amount it will give you the amount of money no mater what amount of money you have in the bank, kind of like the mafia wars glitch, i have pasted the bank.php code bellow if someone will look at it and trey to help me I would appreciate it.

<?php

require_once 'top.php';

?>

<div class=mainback>

<div class=middlebox>

<P><a href=<?php echo $appCanvasUrl; ?>>[Back to Main Menu]</a></P>
<BR>

<?php

if( isset($_POST[submitB]) || isset($_POST[submitD]) || isset($_POST[submitW])) {
	echo $status;
}

?>

<P class=veryBigWhiteP>The Bank</P>

<P>Open a bank account with the minimum balance seen below. A 10% safehouse fee will be taken out of all incoming funds. Once your account is opened, you must maintain a minimum balance of $2000. Money kept in the bank cannot be stolen by other gangsters.</P>
<BR>

<?php

	$res = query("SELECT COUNT(*) FROM `cu_bank` WHERE `userid`=$user");
	list($total_row) = mysql_fetch_array($res);

	if( $total_row > 0 ) {
		$res = query("SELECT * FROM `cu_bank` WHERE `userid`=$user");
		while( $row = mysql_fetch_array($res) ) {
			echo '<P class=titleP>Your balance: '. number_format($row[bamount],2) .'</P><BR>';
		}

		echo '<form action=bank.php method=POST>';
		echo '<P>Deposit: <input type=text name=damount size=20 value=0>&nbsp;&nbsp;<input type=submit name=submitD value="Deposit"></P>';
		echo '</form>';
		echo '<BR>';
		echo '<form action=bank.php method=POST>';
		echo '<P>Withdraw: <input type=text name=wamount size=20 value=0>&nbsp;&nbsp;<input type=submit name=submitW value="Withdraw"></P>';
		echo '</form>';

	}
	else {
		echo '<form action=bank.php method=POST>';
		echo '<P>Initial Balance: <input type=text name=amount size=20 value=10000>&nbsp;&nbsp;<input type=submit name=submitB value="Open Account"></P>';
		echo '</form>';
	}
	

?>

<BR>

</div>

</div>
Member Avatar

diafol

I don't think the problem is with this page. The form handler is the problem. It needs to check whether the balance - withdrawal is less than 2000. If so send an error, else process.

You could tidy up the page with a conditional statement to hide the withdraw form and replace it with something like 'Insufficient funds to make a withrawal' if the balance is less than 2001, e.g.

if(number_format($row[bamount],2) < 2001){
   echo "<p>Insufficient funds...</p>
}else{
  ... (show withdrawal form) ...
}

Some javascript could be used for client-side validation on the withrawal form to check that balance-withrawal < 2000.

[You'll need to introduce 'id' attributes to your input tags, e.g. id="wamount" and form tags, e.g. id='withdrawform']

function checkBalance(balance){
   var myB = balance;
   var wDL = document.getElementById('wamount').value;
//validation should check to ensure that it is a number

   if(myB - wDL < 2000){
      document.getElementById('bmsg').text = 'Insufficient funds...';
   }else{
      document.getElementById('withdrawform').submit;
   }

}

Apply this to the onclick event of the withrawal submit button:

<input type=submit name=submitW value="Withdraw" onclick="checkBalance(<?php echo number_format($row[bamount],2);?>);return false;" />

I've typed this really quickly off the top of my head - it's not tested. The js may need a bit of work.

if( isset($_POST[submitB]) ) {
	if( $_POST[amount] >= 10000 ) {
		$user_cash = get_cash($user);
		if( $_POST[amount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot deposit more money than your current cash!<BR>Please try again later...</P><BR></div>';
		else {
			$res = query("INSERT INTO `cu_bank` (`userid`, `bamount`) VALUES ( $user, $_POST[amount])");
			$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`-$_POST[amount]) WHERE `userid`=$user");
			if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>You successfully opened a bank account!</P><BR></div>'; }
			else $status = '<div class=noticeBox><P class=redNoticeP>There was an error while opening your bank account!<BR>Please try again later...</P><BR></div>';
		}
	}
	else $status = '<div class=noticeBox><P class=redNoticeP>You need $10,000 initial balance to open a new bank account!</P><BR></div>';
}

if( isset($_POST[submitD]) ) {

	$user_cash = get_cash($user);
	if( $_POST[damount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot deposit more money than your current cash!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`+$_POST[damount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`-$_POST[damount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Deposit was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error while depositing your amount!<BR>Please try again later...</P><BR></div>';
	}
}

if( isset($_POST[submitW]) ) {

	$user_cash = get_bank_cash($user);
	if( $_POST[wamount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot withdraw more than your bank balance!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`-$_POST[wamount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`+$_POST[wamount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Withdraw was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error in withdrawal process!<BR>Please try again later...</P><BR></div>';
	}
}

I just found this code in the top.php I don;t know if this is what is causing the problem but can someone see if they can find errors? Thanks!

Member Avatar

diafol

Well, this is the bit that reacts to the withdrawal form:

if( isset($_POST[submitW]) ) {

	$user_cash = get_bank_cash($user);
	if( $_POST[wamount] > $user_cash ) $status = '<div class=noticeBox><P class=redNoticeP>Sorry! You cannot withdraw more than your bank balance!<BR>Please try again later...</P><BR></div>';
	else {
		$res = query("UPDATE `cu_bank` SET `bamount`=(`bamount`-$_POST[wamount]) WHERE `userid`=$user");
		$res = query("UPDATE `cu_users` SET `ucash`=(`ucash`+$_POST[wamount]) WHERE `userid`=$user");
		if( $res ) { $status = '<div class=noticeBox><P class=redNoticeP>Withdraw was successful!</P><BR></div>'; }
		else $status = '<div class=noticeBox><P class=redNoticeP>There was an error in withdrawal process!<BR>Please try again later...</P><BR></div>';
	}
}

Did you say you BOUGHT this script?? This is seriously bad.

The whole thing stinks. There are no id attributes in the HTML tags - the name attributes values do not have quotes around them. The pHp variables (e.g. $_POST[submitW]) are not written properly (should be $_POST) etc. HTML tags are all uppercase... I could go on.

If I were you, I'd write my own. This app is dead simple to create and if you did spend money on it, ask for a refund as it doesn't work.