Users get pass simple If check - php

Question

I have a browser game where you can upgrade your attack,defence,spies and patrol by clicking on submit button. every upgrade cost X gold and X food.
this is the address to the game (it's in hebrew):
http://www.mafia.co.il
In the last few days some users found a way to upgrade it without having enough gold/food. The result is that they have minus in that resource of the game. ofcourse I thought I blocked this option.
also, for some reason they are able to upgrade it more then 10 times - when you'll read the code you'll see that I at least try to block that option.
Please does someone have any idea where is the problem?
This is the upgrade code (I translate the hebrew parts to english, I also added notes):
the reason for the foreach loop is to get the name of the $_POST.
elseif (isset($_POST['attack']) || isset($_POST['defence']) || isset($_POST['spies']) || isset($_POST['patrols'])) {
// Get user details
$ud = details($user_id);
foreach($_POST as $name => $val) {
// Number came with ','. So here i'm removing it.
$pr['gold'] = str_replace(',','',get_upg_price($ud['cvl'][$name]));
$pr['food'] = str_replace(',','',get_upg_price($ud['cvl'][$name]));
// Check if the user has enough food and gold.
if (check_rsc($pr,$ud)) {
// Check if user has maximum upgrade possible.
if ($ud['cvl'][$name] < 10) {
mysql_query("UPDATE `civ_level` SET ".$name."=".$name."+1 WHERE ID='".$user_id."'");
mysql_query("UPDATE `resources` SET gold=gold-'".$pr['gold']."', food=food-'".$pr['food']."' WHERE ID='".$user_id."'");
update_power($user_id);
} else {
$error = "<tr><td colspan='8' style='color:black; background: #CC3333; border:1px solid white;'>you are at maximum possible upgrade.</td></tr>";
}
} else {
$error = "<tr><td colspan='8' style='color:black; background: #CC3333; border:1px solid white;'>You dont have enough resources.</td></tr>";
}
}
}
Function details:
function details($id) {
$select1 = mysql_query("SELECT * FROM `users` WHERE ID='".$id."'");
$sel = mysql_fetch_array($select1);
$array['usr'] = $sel;
$select2 = mysql_query("SELECT * FROM `user_d` WHERE ID='".$id."'");
$sel2 = mysql_fetch_array($select2);
$array['usd'] = $sel2;
$select3 = mysql_query("SELECT * FROM `resources` WHERE ID='".$id."'");
$sel3 = mysql_fetch_assoc($select3);
$array['rsc'] = $sel3;
$select4 = mysql_query("SELECT * FROM `train_price`");
$sel4 = mysql_fetch_assoc($select4);
$array['trp'] = $sel4;
$select5 = mysql_query("SELECT * FROM `civ_level` WHERE ID='".$id."'");
$sel5 = mysql_fetch_array($select5);
$array['cvl'] = $sel5;
if (empty($array['usd'])) {
return false;
} else {
return $array;
}
}
Function get_upg_price:
function get_upg_price($level) {
$a = 0;
$price = 100;
while ($a<$level) {
$price = $price*3;
$a++;
}
return number_format($price);
}
Function check_rsc:
function check_rsc($array,$ud) {
foreach ($array as $name => $val) {
if ($ud['rsc'][$name] < $val) {
return false;
}
}
return true;
}
Example of an input:
<form method='post'><input type='submit' name='attack' value='train' />
Thank you!

Answer 1

Always but always Use addslashes($userInput),
The addslashes function will keep you safe from the sql injection and preventing you from users to cheat on the game.
Never let the variable go directly on the database
That is your error