MArcomage

You seem to be overly trusting of user input in the settings page, so someone can set their Gender/Country/Status to something not among the dropdown options, and mess stuff up. This should throw an error message.

(This is why I have next to my name in the players page a white box, or a bit of text saying "status flag", depending on which browser you use. P.S. Can I keep it?)

Yes, it seems there is no check in select options. Fortunately everything is escaped, so no real damage can be done. I'll add this to my TODO list.

dindon wrote:
(This is why I have next to my name in the players page a white box, or a bit of text saying "status flag", depending on which browser you use. P.S. Can I keep it?)

I would prefer if you corrected your status to normal.

I just wanted to be special! ;_;

Fiiine, fixed.

Very good :)

Cookie????? He needs a reward now :P

Very well.

* gives cookie *

:P

Yay!

It's Username=dindon; expires=Sun, 16-Jan-2011 01:05:49 GMT SessionID=21362*****; expires=Sun, 16-Jan-2011 01:05:49 GMT flavoured!

I see what you did there.

We should design awards for people finding flaws in the game :P

the COOKIE AWARD.

I'm hungry, i'll go get a cookie...

clever btw ;) kudos to dindon :D

Or you could be like Google and pay $500+ per bug found.

(Applied retroactively, of course.)

I feel the need to disclose that I am eating cookies RIGHT NOW.

If anything, dindon certainly deserves an award for the accomplishment of being banned the most times by the host while trying to investigate site weaknesses.

we could pay 500 cookies!!!!!

Nice one :)
Tell me, did you find that out with a TamperData-like plugin, or by actually reading the source code?
(noone but us seems to want to read the source code :(
EDIT: maybe I should go and clean it up sometime

Both (mostly the former).

By the way, I read the source code. It actually looks pretty nice to me. It's certainly made huge improvements since the days when card effects were all stored in a big switch statement :P

The only big thing I don't like about it is all the raw SQL queries. It would be so much easier to use an ORM.

dimitris suggested to use PDO, which is a good idea as well.