<?php
session_start();
include 'config.php';
if($install === 'yes') {
mysql_connect($mysqlhost, $mysqlname, $mysqlpass);
mysql_select_db($mysqldb);
$path = explode('/', $_GET['arg']);
include 'Debbo.php';
include 'Zabboweb.php';
$mysql = new debbo;
$zabboweb = new zabboweb;
$name = $zabboweb->config(name);
$ssostatus = $zabboweb->config(ssostatus);
$sitepath = $zabboweb->config(sitepath);
$imgpath = $zabboweb->config(imgpath);
$htaccess = 'v0';
$footer = 'phelpsy';
$dcrs = $zabboweb->config(dcrs);
$texts = $zabboweb->config(texts);
$vars = $zabboweb->config(vars);
$serverhost = $zabboweb->config(serverhost);
$serverport = $zabboweb->config(serverport);
$ads = 'no';
$online = mysql_query("SELECT `credits` FROM `users` WHERE `name` = \''. $username .'\' LIMIT 1");
if($_SESSION[login] == 'true') {
$rank = $mysql->rank($_SESSION['habboname']);
}
$habboname = $_SESSION['habboname'];
if($rank == 'admin') {
$edit = 'yes';
if($_GET[addbox] && $edit == 'yes') {
$zabboweb->addbox($_GET[page], $_GET[colum]);
} if($_GET[boxcolore] && $edit == 'yes') {
$zabboweb->boxcolore($_GET[id], $_GET[boxcolore]);
} if($_GET[nobox] && $edit == 'yes') {
$zabboweb->nobox($_GET[id]);
} if($_POST[boxcontent] && $edit == 'yes') {
$zabboweb->updatebox($_GET[id], $_POST[boxcontent], $_POST[title]);
} }
 if($_POST[menu] && $edit == 'yes') {
   if($_POST[name] == 'credits') {
  } else {
  $zabboweb->menuthings($_POST[name], $_POST[url], $_POST[other], $_POST[menu]);
 }
}if($path[0] == 'account') {
	if ($path[1] == 'register') {
		if ($_POST['step'] == 'first') {
			$include = 'register1.php';
			$_SESSION['birthdayday'] = $_POST['day'];
			$_SESSION['birthdaymonth'] = $_POST['month'];
			$_SESSION['birthdayyear'] = $_POST['year'];
      include 'incl/basic.php';
	} elseif ($path[3] == '2') {
		if(!$_SESSION['birthdayday']||!$_SESSION['birthdaymonth']||!$_SESSION['birthdayyear']) {
				header('Location: '. $sitepath);
				die;
			}
			$_SESSION['newfigure'] = $_GET['figure'];
			$_SESSION['newgender'] = $_GET['gender'];
			
			$include = 'register2.php';
include 'incl/basic.php';
		
	} elseif ($path[3] == '3') {
		if(!$_SESSION['birthdayday']||!$_SESSION['birthdaymonth']||!$_SESSION['birthdayyear']||!$_SESSION['newfigure']||!$_SESSION['newgender']) {
				header('Location: '. $sitepath);
				die;
			}
			$users = $mysql->users($_POST['username']);
			if($users == 'true') {
			$_SESSION['reg_habboname'] = $_POST['username'];
			$_SESSION['password'] = $_POST['password'];
		$include = 'register3.php';
			} else {
			$error = 'username';
      $include = 'register2.php';
			}
			include 'incl/basic.php';
		} elseif ($path[3] == '4') {
			if(!$_SESSION['birthdayday']||!$_SESSION['birthdaymonth']||!$_SESSION['birthdayyear']||!$_SESSION['newfigure']||!$_SESSION['newgender']||!$_SESSION['reg_habboname']||!$_SESSION['password']) {
				header('Location: '. $sitepath);
				die;
			}
			$_SESSION['email'] = $_POST['email'];
			
		$include = 'register4.php';
		include 'incl/basic.php';
		
			
			
		} elseif ($path[2] == 'done') {
			if(!$_SESSION['birthdayday']||!$_SESSION['birthdaymonth']||!$_SESSION['birthdayyear']||!$_SESSION['newfigure']||!$_SESSION['newgender']||!$_SESSION['reg_habboname']||!$_SESSION['password']||!$_SESSION['email']) {
				header('Location: '. $sitepath);
				die;
			}
			if($_POST['T-O-S'] != true) {
				header('Location: '. $sitepath .'account/register/step/4');
			}
			
			$birthday = $zabboweb->birth($_SESSION['birthdayday'], $_SESSION['birthdaymonth'], $_SESSION['birthdayyear']);
			$mysql->Register(strtolower($_SESSION['reg_habboname']), $_SESSION['password'], $_SESSION['newfigure'], $_SESSION['newgender'], $_SESSION['email'], $birthday);
			$login = $mysql->Login($_SESSION['reg_habboname'], $_SESSION['password']);
			if (strtolower($login) == strtolower($_SESSION['reg_habboname'])) {
				$_SESSION['username'] = $_SESSION['reg_habboname'];
				$_SESSION['habboname'] = $login;
				$_SESSION['login'] = 'true';
			}
			$_SESSION['reg_habboname'] = $_SESSION['password'] = '';
		$include = 'register5.php';
		include 'incl/basic.php';
		}
	} elseif($path[1] == 'login') {
		$fwrd = ($_GET['forward'] ? '<input type="hidden" name="fwrd" value="'.$_GET['forward'].'" />' : '');
		$include = 'login.php';
		include 'incl/basic.php';
		
	}  elseif($path[1] == 'submit') {
		if($_POST['username']) {
			$login = $mysql->Login($_POST['username'], $_POST['password']);
			if (strtolower($login) == strtolower($_POST['username'])) {
				$_SESSION['username'] = $_POST['username'];
				$_SESSION['habboname'] = $login;
				$_SESSION['login'] = 'true';
				if ($_POST['fwrd']) { $extend = $_POST['fwrd']; }
				header('Location: '. $sitepath . $extend);
				die;
			} else {
				$error = $login;
				$err = 'yes';
			}
		}
		$fwrd = ($_GET['forward'] ? '<input type="hidden" name="fwrd" value="'.$_GET['forward'].'" />' : '');
		$include = 'login.php';
		include 'incl/basic.php';
		
	} elseif ($path[1] == 'logout') {
		$_SESSION['username'] = '';
		$_SESSION['habboname'] = '';
		$_SESSION['login'] = '';
		header('Location: '. $sitepath);
	}
} elseif ($path[0] == 'myzabbo') {
	if($path[1] == 'credits') {
		$credits = $mysql->GetUser($_SESSION['username'], 'credits');
		 if ($credits > 0) {
			return print 'You have <span id="amount-credits" class="amount habbocredits">'. $credits .'</span> credits';
		} else {
			return print 'You have no Credits';
		}
	} elseif ($path[1] == 'zabboclub') {
		$hc = $mysql->GetUser($_SESSION['username'], 'hc');
		 if ($hc > 0) {
			return print 'You have <span id="amount-credits" class="amount">'. $hc .'</span> days left in your subscription';
		} else {
			return print 'You are not subscribed to Habbo Club.';
		}
	}
} elseif($path[0] == 'external') {
if ($path[1] == 'texts') {
$text = $mysql->texts();
echo("$text");
} elseif ($path[1] == 'vars') {
$textsname = 'zabbo';
include 'external_vars.txt';
}
} elseif($path[0] == 'client') {
if($_SESSION[login] === 'true') {
	$ssoticket = $mysql->SSO($_SESSION['habboname']);
		include 'incl/client.php';
		}
	}
 elseif($path[0] == 'home') {
 $homez = $path[1];
  if ($path[1] == 'save') {
 if($_POST['datastrip']){
 $long = explode("---",$_POST['datastrip']);
 for ($i=0; $i<=500; $i++)
 {
 if(isset($long[$i])){
 $props = explode(",",$long[$i]);
 $name = $props[0];
 $name = str_replace("S_","",$name);
 $y = $props[1]-22;
 $x = $props[2]-4;
 $z = $props[3];

		if($props[2] == '1'){
			mysql_query("DELETE FROM stickers WHERE id = '$name'");
		}
		else{
			$row = mysql_query("SELECT * FROM stickers WHERE id = '$name'");
			$row2 = mysql_fetch_array($row);
			if($row2['type']=="bprofile" && $x=="h") {
			mysql_query("DELETE FROM stickers WHERE id = '$name'");
			}
			else{
			mysql_query("UPDATE stickers SET y = '$y' WHERE id = '$name'");
			mysql_query("UPDATE stickers SET x = '$x' WHERE id = '$name'");
			mysql_query("UPDATE stickers SET z = '$z' WHERE id = '$name'");
			}
		}
 	}
 }
 }
 }
 elseif ($path[1] == 'edit') {
 if ($path[2] == 'bgshop') {
 if($_SESSION[login] == 'true'){ ?>
 <div style="overflow: auto; height: 500px; width: 470px;">
<center>
<table width="90%" cellspacing="0" cellpadding="0">
<tr>
<td width="100%">
<?php if($path[3] == 'buy'){ 
if(!$path[4]){ echo "error"; }
else{
$back = $path[4];
mysql_query("UPDATE homes SET bg = '$back' WHERE owner = '$_SESSION[habboname]'");
?>
<div class="v3box orange">
	<div class="v3box-top"><h3>Background Changed Successfully!</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Congratulations, your background has been changed successfully.<br />
	<a href="javascript:window.location.reload();">Back to my home</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
<br />
<?php } } ?>
<table width="90%" align="center">
<tr>
<?php 
$q = "SELECT * FROM cat_bgs";
$retrocide = mysql_query($q);
while($row = mysql_fetch_array($retrocide)){ 
if($i=="5" || $i=="15" || $i=="25" || $i=="35" || $i=="45" || $i=="55" || $i=="65" || $i=="75" || $i=="85" || $i=="95" || $i=="105" || $i=="115" || $i=="125" || $i=="135" || $i=="145" || $i=="155" || $i=="165" || $i=="175" || $i=="185" || $i=="195" || $i=="205" || $i=="215" || $i=="225" || $i=="235" || $i=="245" || $i=="10" || $i=="20" || $i=="30" || $i=="40" || $i=="50" || $i=="60" || $i=="70" || $i=="80" || $i=="90" || $i=="100" || $i=="110" || $i=="120" || $i=="130" || $i=="140" || $i=="150" || $i=="160" || $i=="170" || $i=="180" || $i=="190" || $i=="200" || $i=="210" || $i=="220" || $i=="230" || $i=="240" || $i=="250") { echo "</tr><tr>"; }
?>
<td align="center">
<div class="inventory-item <?php echo $row['class']; ?>" style="background-repeat: repeat;">
<div><a href="../bgshop/buy/<?php echo $row['class']; ?>" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>Change</span></a></div>
</div>
</td>
<?
$i++;
} ?>
</tr>
</table>
</td>
</tr>
</table>
</center>
<?
} else {
?>
<center>
<div style="width: 50%;">
<div class="v3box orange">
	<div class="v3box-top"><h3>Error</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Sorry, you must be logged in to do that.<br /><a href="homes_index.php">Login/Register</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
</div>
</center>
<?
$homez = $path[2];
 } } elseif ($path[2] == 'stickershop') {
 if($_SESSION[login] == 'true'){ ?>
 <div style="overflow: auto; height: 500px;">
<center>
<table width="90%" cellspacing="0" cellpadding="0">
<tr>
<td width="100%">
<?php if($path[3] == 'buy'){ 
if(!$path[4]){ echo "error"; }
else{
$buy = $path[4];
$checkexist = mysql_query("SELECT * FROM cat_stickers WHERE class = '$buy'");
if(!mysql_num_rows($checkexist)=="0"){
mysql_query("INSERT INTO stickers VALUES ('', '$buy', '$_SESSION[habboname]', '0','0','','','','')");
}
else{
$hacker = "1";
}
?>
<div class="v3box orange">
	<div class="v3box-top"><h3><?php if($hacker=="1"){ ?>Nice Try...<?php } else { ?>Sticker Added Successfully!<?php } ?></h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Congratulations, your sticker has been added.<br />
	<a href="javascript:window.location.reload();">Back to my home</a>
	<?php } ?>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
<br />
<?php } ?>
<table width="90%" align="center">
<tr>
<?php 
	$q = "SELECT * FROM cat_stickers";
     $retrocide = mysql_query($q);
while($row = mysql_fetch_array($retrocide)){ 
if($i=="5" || $i=="15" || $i=="25" || $i=="35" || $i=="45" || $i=="55" || $i=="65" || $i=="75" || $i=="85" || $i=="95" || $i=="105" || $i=="115" || $i=="125" || $i=="135" || $i=="145" || $i=="155" || $i=="165" || $i=="175" || $i=="185" || $i=="195" || $i=="205" || $i=="215" || $i=="225" || $i=="235" || $i=="245" || $i=="10" || $i=="20" || $i=="30" || $i=="40" || $i=="50" || $i=="60" || $i=="70" || $i=="80" || $i=="90" || $i=="100" || $i=="110" || $i=="120" || $i=="130" || $i=="140" || $i=="150" || $i=="160" || $i=="170" || $i=="180" || $i=="190" || $i=="200" || $i=="210" || $i=="220" || $i=="230" || $i=="240" || $i=="250") { echo "</tr><tr>"; }
?>
<td align="center">
<div class="inventory-item <?php echo $row['class']; ?>">
<div><a href="../stickershop/buy/<?php echo $row['class']; ?>" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>Place</span></a></div>
</div>
</td>
<?
$i++;
} ?>
</tr>
</table>
</td>
</tr>
</table>
</center>
<?
} else {
?>
<center>
<div style="width: 50%;">
<div class="v3box orange">
	<div class="v3box-top"><h3>Error</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Sorry, you must be logged in to do that.<br /><a href="../../../account/login">Login/Register</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
</div>
</center>
<?php }
 
 } elseif ($path[2] == 'noteshop') {
 $post = $path[3];
 if($_SESSION[login] == 'true') { ?>
<center>
<table width="90%" cellspacing="0" cellpadding="0">
<tr>
<td width="100%">
	<form action="<?php echo("$habboname"); ?>" method="post">
	<textarea name="notecontent" cols="40" rows="5"></textarea>
	<br /><br />
	<input type="submit" name="submit" value="Make Note" />
	</form>
</td>
</tr>
</table>
</center>
<?
} else {
?>
<center>
<div style="width: 50%;">
<div class="v3box orange">
	<div class="v3box-top"><h3>Error</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Sorry, you must be logged in to do that.<br /><a href="../../../account/login">Login/Register</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
</div>
</center>
<?
 }
 
 } elseif($path[2] == 'gbpost') {
 $post = $path[3];
 ?>
Posting in <?php echo ("$post"); ?>'s Guestbook...<br /><br />
<form action="<?php echo ("$post"); ?>" method="post">
<textarea name="comment" cols="30" rows="7">

</textarea>
<br /><br />
<input type="submit" value="Post" name="submit" />
</form>
<?
 } elseif ($path[2] == 'widgetshop') {
 if($_SESSION[login] == 'true'){ ?>
<center>
<table width="90%" cellspacing="0" cellpadding="0">
<tr>
<td width="100%" valign="top">
<?php if($path[3] == 'buy'){ 
if(!$path[4]){ echo "error"; }
mysql_query("INSERT INTO stickers VALUES ('', '', '$_SESSION[habboname]', '200', '200', '', '$path[4]', '', '')");
?>
<div class="v3box orange">
	<div class="v3box-top"><h3>Widget Added Successfully!</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Congratulations, your widget has been added.<br />
	<a href="javascript:window.location.reload();">Back to my home</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
<br />
<?php }  ?>
<table width="90%" align="center">
<tr>
<?
$profchk = mysql_query("SELECT * FROM stickers WHERE type = 'profile' AND home = '$habboname'");
if(mysql_num_rows($profchk)=="0"){ ?>
<td align="center">
<div class="inventory-item" style="background-image: url(<?php echo("$imgpath") ?>images/homes/profilewidget.png);">
<div><a href="../widgetshop/buy/profile" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>Place</span></a></div>
</div>
</td>
<?php }
$profchk = mysql_query("SELECT * FROM stickers WHERE type = 'guestbook' AND home = '$habboname'");
if(mysql_num_rows($profchk)=="0"){ ?>
<td align="center">
<div class="inventory-item" style="background-image: url(<?php echo("$imgpath") ?>images/homes/gbwidget.png);">
<div><a href="../widgetshop/buy/guestbook" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>Place</span></a></div>
</div>
</td>
<?php } ?>
</tr>
</table>
</td>
</tr>
</table>
</center>
<?
} else {
?>
<center>
<div style="width: 50%;">
<div class="v3box orange">
	<div class="v3box-top"><h3>Error</h3></div>
	<div class="v3box-content">
		<div class="v3box-body">
	Sorry, you must be logged in to do that.<br /><a href="../../../account/login">Login/Register</a>
	</div>
	</div>
<div class="v3box-bottom"><div></div></div>
</div>
</div>
</center>
<?php } ?>
<?
 } elseif($path[2] == 'skins') {
 if($_GET['new']) {
 mysql_query("UPDATE stickers SET skin = '$_GET[new]' WHERE id = '$path[3]'");
 }
 ?>
 <table height="2px" width="370px" cellpadding="0" cellspacing="0">
<tr>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=metal" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>metal</span></a>
</td>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=golden" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>gold</span></a>
</td>
 <td valign="top">
<div><a href="../skins/<?php echo("$_GET[id]") ?>?new=hc_pillow" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>pillow</span></a>
</td>
 <td valign="top">
<div><a href="../skins/<?php echo("$_GET[id]") ?>?new=speechbubble" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>speech</span></a>
</td>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=noteit" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>note</span></a>
</td>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=notepad" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>notepad</span></a>
</td>
</tr>
</table>
 <table width="180px" cellpadding="0" cellspacing="0">
<tr>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=hc_machine" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>hc machine</span></a>
</td>
 <td valign="top">
<a href="../skins/<?php echo("$_GET[id]") ?>?new=default" class="lbAction colorlink noarrow narrowbutton"  rel="insert"><span>default</span></a>
</td>
</tr>
</table>
 <?
 } elseif($path[2] == 'frame' && $path[1] == 'edit') {
 if($_POST['notecontent']){
$content = htmlspecialchars($_POST['notecontent']);
mysql_query("INSERT INTO stickers VALUES ('', '', '$habboname', '0','0','0','note','$content','default')");
}
  $edithome = 'true';
 $homez = $path[3];
 $page = 'home';
 $include = 'zomes.php';
 include 'incl/basic.php';
 } else {
 $edithome = 'true';
 $homez = $path[2];
 $page = 'home';
 $include = 'full.php';
 include 'incl/basic.php';
 }
 }
  else {
 $page = 'home';
 $include = 'full.php';
 include 'incl/basic.php';
 }
 } 
 elseif($path[0] == help) {
 $page = 'help';
 $habboname = $_SESSION['habboname'];
 $include = 'full.php';
 include 'incl/basic.php';
 } 
 elseif($path[0] == 'profile') {
 $page = 'profile';
 $include = 'full.php';
 include 'incl/basic.php';
 } else {
 if($_POST['doRedeem']) {
  $credits = $mysql->GetUser($_SESSION['habboname'], 'credits');
   $voucher = $mysql->code($_SESSION['username'], $_POST['redeem-code']);
    $coin = ($voucher + $credits);
	  $mysql->coinbuy($_SESSION['username'], $coin);
	 $mysql->delvoucher($voucher, $_POST['redeem-code']);
  }
  $pagez = $zabboweb->pages($path[0]);
  if($pagez == false) {
  $page = 'index';
  } else {
  $page = $path[0];
  if($pagez[who] == 'admin' && !$edit == 'yes'){
  $page = 'index';
  }
 }
 $habboname = $_SESSION['habboname'];
 $include = 'full.php';
 include 'incl/basic.php';
}
} else {
header('Location: /install/index.php');
die;
}
?>