Stripping . from text box's - php

Question

Hello i did use the search before posting this.
Im new to php/mysql been doing soooo much reading. have been able to make a game that a few friends are playing. its like a pvp game.
Anyway one of the people playing found a way to glitch buying and selling units by putting a . in front of the value. i do have a protect feature for stripping illegal characters
function protect($string) {
return mysql_real_escape_string(strip_tags(addslashes($string)));
}
this works for other characters but not with . im not asking for someone to do it for me just wanted to be pointed in the right direction.
but just encase someone asks here is the code im using
if(isset($_POST['buy'])){
$sword = protect($_POST['sword']);
$shield = protect($_POST['shield']);
$gold_needed = (10 * $sword) + (10 * $shield);
if($sword < 0 || $shield < 0){
output("You must buy a positive number of weapons!");
}elseif($stats['gold'] < $gold_needed){
output("You do not have enough gold!");
}else{
$weapon['sword'] += $sword;
$weapon['shield'] += $shield;
$update_weapons = mysql_query("UPDATE `weapon` SET
`sword`='".$weapon['sword']."',
`shield`='".$weapon['shield']."'
WHERE `id`='".$_SESSION['uid']."'") or die(mysql_error());
$stats['gold'] -= $gold_needed;
$update_gold = mysql_query("UPDATE `stats` SET `gold`='".$stats['gold']."'
WHERE `id`='".$_SESSION['uid']."'") or die(mysql_error());
include("update_stats.php");
output("You have bought weapons!");
}
If anyone could give me a hand i would greatly appreciate it
i did find something "string functions, substr replace and str replace"
but can i use two functions in 1 query? sorry im new
EDIT***
Here is the query posted in update_stats
$update_stats = mysql_query("UPDATE `stats` SET
`income`='".$income."',`farming`='".$farming."',
`attack`='".$attack."',`defense`='".$defense."'
WHERE `id`='".$_SESSION['uid']."'") or die(mysql_error());

Answer 1

one of the people playing found a way to glitch buying and selling units by putting a . in front of the value
Well, you've not disclosed EXACTLY what the vulnerability is, but I'll hazard a guess that by input of a decimal value they run around your pricing/math? So, a number of possibilities, I should think?
if (substr($string, 0, 1) == ".") {
//return false, warn, etc.
}
That could go in your "protect" function.
Likewise, you could use intval() or even is_numeric() ... here I just add it to the assignment:
$sword = protect(intval($_POST['sword']));
You could also play with a regular expression. I'm assuming $value to be numeric? How many digits max? I've used 5:
if (preg_match("%\.\d{1,5}%", $sword)) { //this guy's playing w/us
die("Go away, bad hax0rz! :-P");
}