Full Point System

ALTER TABLE `members` ADD `pin` VARCHAR( 255 ) NULL,
ADD `has_bank` INT( 1 ) NOT NULL default '0',
ADD `points` INT( 11 ) NOT NULL default '50';
 
CREATE TABLE `banks` (
`id` INT( 11 ) NOT NULL auto_increment,
`username` VARCHAR( 255 ) NOT NULL,
`points` INT( 11 ) NOT NULL default '0',
`pin` VARCHAR( 255 ) NULL,
PRIMARY KEY(`id`)
);

<?php
function secure($var){ //secure pin code function
$p = $var; //yawn? lets give it a simpler name :D
$md5 = md5(md5(md5(md5(md5($p))))); //md5 the pin/variablke
$sha1 = sha1(sha1(sha1(sha1(sha1($p))))); //sha1 the pin/text
$compile = "xX-$md5-$sha1-Xx"; //combine them 
$secure_full = md5(sha1($compile)); //md5 and sha1 them :D
return $secure_full; //return the code
} //end function
function checkpin($pinhash){ //check our pin
	$pin = $pinhash; //easier name
	$pins = mysql_query("SELECT  * FROM `members` WHERE `pin` = '$pin';") or die(mysql_error()); //get pins from members table
	if(empty($pin)){ //UHOH they left it empty
		return false; //BAD! you fail =]
	} //end empty check
	if(mysql_num_rows($pins) == 0){ //no pins found =(
		return false; //fail.
	} //end
	if(mysql_num_rows($pins) >= 1){ //more then 1 found :D
		return true; //true!!! pass!!!!
	} //end 
} //end function
?>

<?php
session_start(); //allow sessions
require("config.php"); //get configuration
if(!$logged['username']){ //not logged in
    print "You Must Be Logged In For Use of This Function!";
}else{ //they are logged in
    if($logged['has_bank'] == 0){ //user doesn't have a bank account
        if(!$_POST['getbank']){ //form not submitted
            print "<form method=\"post\">
            <strong>Pin Code</strong>
            <input type=\"password\" size=\"15\" name=\"pincode\" maxlength=\"4\" />
            <input type=\"submit\" name=\"getbank\" value=\"Get Bank!\" />
            </form>";
        }else{ //form was submitted
            $pin = (int)$_POST['pincode']; //this is our un-encrypted pin
            $enc_pin = secure($pin); //new pin for database
            if(empty($pin)){ //it was empty =(
                print "You Must Enter a 4 Digit Pin Code!";
            }else{ //maybe not..
                if(strlen($pin) < '4' || strlen($pin) > '4'){ //too long or too short
                    print "Pin Must Be 4 Digits Long!";
                }else{ //not.
                    $update_user = mysql_query("UPDATE `members` SET `has_bank` = '1', `pin` = '$enc_pin' WHERE `username` = '$logged[username]';") or die(mysql_error()); //update the user
                    $insert_bank = mysql_query("INSERT INTO `banks` (`username`,`pin`) VALUES ('$logged[username]','$enc_pin');") or die(mysql_error()); //give them a bank account
                    print "Bank Setup Successfully!";
                }
            }
        }
    }else{
        switch($_GET['page']){
            default:
                $getBank = mysql_query("SELECT * FROM `banks` WHERE `username` = '$logged[username]';"); //get the bank for the logged user
                $bArray = mysql_fetch_array($getBank); //array the data.
                print "<p>
                Welcome to the bank $logged[username]
                You Have $logged[points] in your hand and $bArray[points] in your bank account for a total of ".($logged[points] + $bArray[points])." points.
                What would you like to do?</p>
                <table width=\"300\">
                <tr>
                <td align=\"center\" valign=\"middle\">
                <a href=\"bank.php?page=withdraw\">Withdraw Points</a>
                </td>
                <td align=\"center\" valign=\"middle\">
                <a href=\"bank.php?page=deposit\">Deposit Points</a>
                </td>
                </tr>
                <tr>
                <td align=\"center\" valign=\"middle\">
                <a href=\"bank.php?page=changepin\">Change Pin</a>
                </td>
                <td align=\"center\" valign=\"middle\">
                <a href=\"bank.php?page=forgotpin\">Forgot Pin</a>
                </td>
                </tr>
                </table>";
                break;
            case 'withdraw': //the withdraw points page
                $getBank = mysql_query("SELECT * FROM `banks` WHERE `username` = '$logged[username]';"); //get the bank for the logged user
                $bArray = mysql_fetch_array($getBank); //array the data.
                if(!$_POST['withdraw']){ //form not submitted
                    print "<form method=\"post\">
                    You Have $bArray[points] In Bank!
                    <strong>Withdraw Amount</strong>
                    <input type=\"text\" name=\"amount\" value=\"0\" />
                    <strong>Your Pin</strong>
                    <input type=\"password\" name=\"mypin\" size=\"15\" />
                    <input type=\"submit\" name=\"withdraw\" value=\"Withdraw Points!\" />
                    </form>";
                }else{ //it was
                    $pin = (int)$_POST['mypin']; //our pin
                    $withdrawpoints = (int) $_POST['amount']; //ammount wanted
                    $errors = array(); //errors
                    if(empty($pin)){ //empty pin
                        $errors[] = "You Must Enter your 4 Digit Pin Code!";
                    }
                    if(empty($withdrawpoints)){ //no moneyto withdraw
                        $errors[] = "You Must Enter an Amount of Money!";
                    }
                    if($bArray['points'] < $withdrawpoints){ //not enough points
                        $errors[] = "You Don't Have That Much Money In Your Bank!";
                    }
                    if(!checkpin(secure($pin))){ //invalid pin code
                        $errors[] = "Invalid PIN Code!";
                    }
                    if($bArray['pin'] != secure($pin)){ //wrong pin code:O
                        $errors[] = "Invalid Bank PIN!";
                    }
                    if($withdrawpoints < 0){
                    	$errors[] = "Invalid Amount of Points!";
                    }
                    if(count($errors) > 0){ //errors found
                        foreach($errors as $err){ //loop for all errors
                            print $err.''; //print the error
                        } //end loop
                    }else{ //none found
                        $newbankpoints = ($bArray['points'] - $withdrawpoints); //new bank amount
                        $newhandpoints = ($logged['points'] + $withdrawpoints); //new hand amount
                        $update_hand = mysql_query("UPDATE     `members` SET `points` = '$newhandpoints' WHERE `username` = '$logged[username]';") or die(mysql_error());
                        $update_bank = mysql_query("UPDATE `banks` SET `points` = '$newbankpoints' WHERE `username` = '$logged[username]';") or die(mysql_error());
                        print "$withdrawpoints Points has been withdrawn.";
                    } //end errors count
                } //end form check
                break;
            case 'deposit': //depposit points page
                $getBank = mysql_query("SELECT * FROM `banks` WHERE `username` = '$logged[username]';"); //get the bank for the logged user
                $bArray = mysql_fetch_array($getBank); //array the data.
                if(!$_POST['deposit']){ //form not submitted
                    print "<form method=\"post\">
                    You Have $logged[points] In Hand!
                    <strong>Withdraw Amount</strong>
                    <input type=\"text\" name=\"amount\" value=\"0\" />
                    <strong>Your Pin</strong>
                    <input type=\"password\" name=\"mypin\" size=\"15\" />
                    <input type=\"submit\" name=\"deposit\" value=\"Deposit Points!\" />
                    </form>";
                }else{ //it was
                    $pin = (int)$_POST['mypin']; //our pin
                    $depositpoints = (int) $_POST['amount']; //ammount wanted
                    $errors = array(); //errors
                    if(empty($pin)){ //empty pin
                        $errors[] = "You Must Enter your 4 Digit Pin Code!";
                    }
                    if(empty($depositpoints)){ //no money to deposit
                        $errors[] = "You Must Enter an Amount of Money!";
                    }
                    if($logged['points'] < $depositpoints){ //not enough points
                        $errors[] = "You Don't Have That Much Money In Your Hand!";
                    }
                    if(!checkpin(secure($pin))){ //invalid pin code
                        $errors[] = "Invalid PIN Code!";
                    }
                    if($bArray['pin'] != secure($pin)){ //wrong pin code:O
                        $errors[] = "Invalid Bank PIN!";
                    }
                    if($depositpoints < 0){
                    	$errors[] = "Invalid Amount of Points!";
                    }
                    if(count($errors) > 0){ //errors found
                        foreach($errors as $err){ //loop for all errors
                            print $err.''; //print the error
                        } //end loop
                    }else{ //none found
                        $newbankpoints = ($bArray['points'] + $depositpoints); //new bank amount
                        $newhandpoints = ($logged['points'] - $depositpoints); //new hand amount
                        $update_hand = mysql_query("UPDATE     `members` SET `points` = '$newhandpoints' WHERE `username` = '$logged[username]';") or die(mysql_error());
                        $update_bank = mysql_query("UPDATE `banks` SET `points` = '$newbankpoints' WHERE `username` = '$logged[username]';") or die(mysql_error());
                        print "$depositpoints Points has been deposited.";
                    } //end errors count
                } //end form check
                break;
            case 'changepin': //change pin page
                $getBank = mysql_query("SELECT * FROM `banks` WHERE `username` = '$logged[username]';"); //get the bank for the logged user
                $bArray = mysql_fetch_array($getBank); //array the data.
                if(!$_POST['changepin']){ //form not submitted
                    print "<form method=\"post\">
                    <strong>Current PIN Code</strong>
                    <input type=\"password\" name=\"cur_pin\" maxlength=\"4\" />
                    <strong>New Pin</strong>
                    <input type=\"password\" name=\"new_pin\" maxlength=\"4\" />
                    <strong>Verify New Pin</strong>
                    <input type=\"password\" name=\"ver_pin\" maxlength=\"4\" />
                    <input type=\"submit\" name=\"changepin\" value=\"Change Pin!\">
                    </form>";
                }else{ //or was it..
                    $pin = (int) $_POST['cur_pin']; //original pin
                    $newpin = (int) $_POST['new_pin'];//new pin
                    $verpin = (int) $_POST['ver_pin'];//verify new
                    $errors = array(); //errors
                    if(empty($pin)){ //no pin given
                        $errors[] = "Current Pin Incorrect.";
                    }
                    if(empty($newpin)){ //no new pin given
                        $errors[] = "You Msut Enter a New Pin!";
                    }
                    if(empty($verpin)){ //no verify new pin given
                        $errors[] = "You Must Verify Your New Pin!";
                    }
                    if($bArray['pin'] != secure($pin)){ //current pin doesnt equal bank current pin
                        $errors[] = "Incorrect Current Pin!";
                    }
                    if($newpin != $verpin){ //new pins dont match
                        $errors[] = "New Pins Do Not Match!";
                    }
                    if(count($errors) > 0){ //errors found
                        foreach($errors as $err){ //loop to print errors on page
                            print $err.'';
                        }
                    }else{ //no errors
                        $update_user_pin = mysql_query("UPDATE `members` SET `pin` = '".secure($newpin)."' WHERE `username` = '$logged[username]';") or die(mysql_error()); //update users pin
                        $update_bank_pin = mysql_query("UPDATE `banks` SET `pin` = '".secure($newpin)."' WHERE `username` = '$logged[username]';"); //update bank pin
                        print "Pin Updated!"; //success
                    } //end errors check
                } //end form submit
                break;
            case 'forgotpin': //forgot my pin code D:
                if(!$_POST['requestnew']){ //form not submitted
                    print "Well, looks like you have forgotten your pin. Too bad you won't be getting it right away. After clicking the button below please check your email for your new pin code.
                    <form method=\"post\">
                    <input type=\"submit\" name=\"requestnew\" value=\"Get New Pin!\" />
                    </form>";
                }else{ //it was
                    $chars = "1234567890"; //available chars
                    $newpin = substr(str_shuffle($chars), 0, 4); //make new pin
                    $update_bank_pin = mysql_query("UPDATE `banks` SET `pin` = '".secure($newpin)."' WHERE `username` = '$logged[username]';") or die(mysql_error());
                    $update_members_pin = mysql_query("UPDATE `members` SET `pin` = '".secure($newpin)."' WHERE `username` = '$logged[username]';") or die(mysql_error());
                    $mail = mail($logged['email'], "New Pin Code", "hello $logged[username], $newpin is your new pin code. please do not lose it."); //email the user
                    if(!$mail){ //not sent
                        print "Error sending email!";
                    }else{//it sent
                        print "Please check your Email for your pin code.";
                    }
                }
                break;
        }
    }
}
?>