Kiddie Kartel

Directory: kiddie_kartel/Kiddie Kartel/

Game Name: Kiddie Kartel (parody kid crime simulator)

Genre: Browser-based strategy/crime game (humorous twist)

Version: Unknown (no version file)

Developer: Unknown (no credits found)

Development Date: Unknown (no timestamps in files)

: No file found (assumed proprietary)

Database: MySQL via PEAR DB abstraction layer

Architecture: Command Pattern with OOP design

Game Concept: Parody of mafia/crime RPGs where players run "neighborhoods" of kids doing petty "crimes" like lawn mowing, lemonade stands, baking cookies, and having water balloon fights. Kids recruit "bullies" and "paper boys" as minions to raid other neighborhoods.

---

Total Files: 117 files

PHP Scripts: 70 files (0.18 MB)

HTML Templates: 45 files (0.05 MB)

Graphics: 1 JPG (logo.jpg, 0.01 MB)

Documentation: 1 TXT file (createDatabase.txt)

Notable Absence: Minimal graphics (only 1 image!), no CSS files, no JavaScript, extremely lightweight.

Directory Structure:

      Kiddie Kartel/
      ├── C[CommandName]Cmd.php (50+ command classes)
      ├── C[ClassName].php (core classes)
      ├── [Feature].html (45 HTML templates)
      ├── settings.php (game configuration)
      ├── main.php (entry point)
      └── graphics/logo.jpg

File Naming Convention:

• All classes prefixed with C (Hungarian notation)
• Commands suffixed with Cmd (e.g., CLoginCmd.php, CBribeCmd.php)
• HTML templates named after actions (e.g., BribeSuccess.html, RazeFailure.html)

---

Architecture: Command Pattern with PEAR DB - Very well-structured OOP design!

Core Design:

1. Command Pattern (CCommand.php):

define("CMD_ERROR", 1);
define("CMD_CONTINUED", 2);
define("CMD_FINISHED", 3);
define("CMD_NEEDS_INPUT", 4);

class CCommand {
    var $m_pParent = null;
    var $m_nCurrentCommand;
    var $m_bNeedRollBack;
    var $m_arraySubCommands;
    
    function Execute($args) { return CMD_FINISHED; }
    function OnRollBack() { /* undo changes */ }
    function HandleSubCommand($result) { /* manage sub-commands */ }
}

Key Innovation: Commands can be chained (sub-commands), rolled back (transaction-like), and interrupted (return CMD_NEEDS_INPUT). This is sophisticated for a browser game! 2. Command Factory (CCommandFactory.php):

• Creates command objects based on $args['type'] parameter
• Centralized command instantiation (good design pattern)

3. Game Controller (CGame.php):

class CGame {
    var $m_Neighborhood;      // player data
    var $m_CurrentCmd;        // executing command
    var $m_CmdFactory;        // command factory
    
    function ExecuteCommand($args) {
        // Credit turns automatically
        if (isset($_SESSION['neighborhood'])) {
            $turn_update = new CCreditTurns($null);
            $turn_update->Execute();
        }
        
        // Handle command interruption/rollback
        if (strtolower(get_class($this->m_CurrentCmd)) != strtolower($args['type'])) {
            $this->m_CurrentCmd->OnRollBack();  // Undo interrupted command!
            $this->m_CurrentCmd = $this->m_CmdFactory->CreateCommand($args['type']);
        }
        
        $result = $this->m_CurrentCmd->Execute($args);
    }
}

Brilliant Feature: If user navigates away mid-command, game rolls back the interrupted command automatically! Very clean error handling. 4. Database Layer - PEAR DB:

      $g_PearDBDSN = "mysql://$g_DBUsername:$g_DBPassword@$g_DBHost/$g_DBName";
      $db = DB::connect($GLOBALS['g_PearDBDSN']);
      $result = $db->Query($query);

PEAR DB = PHP 4/5-era database abstraction (pre-PDO). Better than raw mysql_* but still obsolete.

5. Session Management:

• PHP sessions store $_SESSION['game'] (CGame object)
• $_SESSION['neighborhood'] (CNeighborhood object)
• Persistent game state across requests

6. Configuration System (settings.php - 167 lines):

Extensive game balance variables:

• Turn system: 5 turns per 10 minutes, max 1,000 turns
• Unit costs: Bullies = $10 + 4 cookies, Paper Boys = $20 + 2 lemonades
• Support ratios: 5 paper boys per lemonade stand, 10 bullies per bakery
• Combat formulas: Success rates, loss rates, loot percentages for all actions (Raze, Scare, TakeOver, Bribe, Sabotage, Spy)
• Resource generation: Lawn mowing base/mod/range formulas

All game balance tunable without code changes - excellent design!

---

Core Concept: Kid-friendly parody of mafia games. Instead of drugs/guns, kids have lemonade/cookies and water balloons/plastic bats.

Resource System (3 types):

• Money - Currency (start with $300)
• Lemonade - Supports paper boys (start with 100 glasses)
• Cookies - Supports bullies (start with 50 cookies)

Production Buildings (3 types):

• Lawn Mowers - Generate money (start with 1)
• Formula: $10 base ± 100% randomness (earn $0-$20 per turn)
• Lemonade Stands - Generate lemonade (start with 0)
• Formula: 2 base ± 50% randomness (produce 1-3 glasses per turn)
• Each stand supports 5 paper boys
• Bakeries - Generate cookies (start with 0)
• Formula: 1 base ± 100% randomness (bake 0-2 cookies per turn)
• Each bakery supports 10 bullies

Minions (2 types):

• Paper Boys (cost: $20 + 2 lemonade, train 5 per turn)
• Used for offensive actions
• Bullies (cost: $10 + 4 cookies, train 10 per turn)
• Used for aggressive actions

Equipment (3 types):

• Water Balloons (start with 0)
• Plastic Bats (start with 0)
• Sling Shots (start with 0)

Turn System:

• 50 starting turns
• 5 turns credited every 10 minutes (time-based regeneration)
• Max 1,000 turns stored
• Actions cost 1 turn each

Actions:

Economic Actions (build empire):

• Mow Lawns - Earn money
• Make Lemonade - Produce lemonade
• Bake Cookies - Produce cookies
• Buy Equipment - Purchase water balloons/bats/slingshots
• Recruit - Train bullies or paper boys

Paper Boy Actions (lighter offense):

• Spy - Scout opponent's stats (40% success default)
• Sabotage - Damage opponent's production

Bully Actions (heavy offense):

• Raze - Destroy opponent's buildings (45% success, 0-10% building loss, 0-25% resource loot)
• Scare - Intimidate opponent, kill units (40% success, 25-50% opponent unit loss on success)
• Take Over - Capture opponent's neighborhood (130% difficulty - very hard!)
• Bribe - Corrupt opponent's forces

Combat Mechanics:

Raze Formula (from settings.php lines 49-58):

$g_fRazeSuccess = 0.45;                          // 45% base success
$g_nRazeLemonadeCost = 2;                        // Costs 2 lemonade
$g_nRazeCookieCost = 2;                          // Costs 2 cookies
$g_fRazeBasePlayerLossRate = 0.20;               // You lose 20-50% of attackers
$g_fRazeMaxPlayerLossRate = 0.50;
$g_fRazeBaseOpponentLossRate = 0.10;             // Opponent loses 10-50% defenders
$g_fRazeMaxOpponentLossRate = 0.50;
$g_fRazeMinGeneratorsRazed = 0.00;               // Destroy 0-10% of buildings
$g_fRazeMaxGeneratorsRazed = 0.10;
$g_fRazeMinLoot = 0.00;                          // Steal 0-25% resources
$g_fRazeMaxLoot = 0.25;

Complex formulas with randomness ranges - sophisticated balance system.

Social Features:

• Neighborhood Names - Custom names for player bases
• Top Neighborhoods - Leaderboards
• Statistics - View other players' stats

Account Management:

• Create account
• Login/Logout
• Edit account details
• Move to different neighborhood (server?)

---

Single Table Design: neighborhoods

Fields: 18 columns

Type: MySQL (no explicit engine specified, likely MyISAM default)

Schema:

CREATE TABLE neighborhoods (
    PlayerName          CHAR(64) NOT NULL PRIMARY KEY,
    NeighborhoodName    CHAR(64) NOT NULL,
    Password            CHAR(64) NOT NULL,
    -- Minions
    Bullies             INT DEFAULT 0,
    PaperBoys           INT DEFAULT 0,
    -- Production Buildings
    LawnMowers          INT DEFAULT 1,
    LemonadeStands      INT DEFAULT 0,
    Bakeries            INT DEFAULT 0,
    -- Resources
    Money               INT DEFAULT 300,
    Lemonade            INT DEFAULT 100,
    Cookies             INT DEFAULT 50,
    -- Equipment
    WaterBalloons       INT DEFAULT 0,
    PlasticBats         INT DEFAULT 0,
    SlingShots          INT DEFAULT 0,
    -- Turns
    LastTurnCredited    DATETIME NOT NULL,
    Turns               INT DEFAULT 50
);

Design Quality: 8/10 Strengths:

• Single-table = blazing fast (no JOINs needed!)
• Clean naming convention (PascalCase)
• Sensible defaults (start with 1 lawn mower, $300, 50 turns)
• DATETIME for turn tracking (prevents exploits)
• PlayerName as PRIMARY KEY (enforces uniqueness)

Weaknesses:

• CHAR(64) instead of VARCHAR (wastes space)
• Plaintext password field (no indication of hashing - huge security flaw!)
• No indexes beyond PRIMARY KEY (though single-table makes this less critical)
• No foreign keys (not applicable with single table)
• No audit trail (no created_at, updated_at timestamps)

Scalability: Single table design = excellent performance for small-to-medium games (< 10,000 players). No complex queries, no N+1 problems.

---

This is exceptionally well-designed code for a browser game!

Strengths:

1. Command Pattern Implementation ⭐⭐⭐⭐⭐

• Proper use of design pattern
• Rollback mechanism for transaction safety
• Sub-command chaining support
• Error propagation hierarchy
• Industry-standard architecture

2. Object-Oriented Design ⭐⭐⭐⭐

• Encapsulated classes (CGame, CNeighborhood, CCommand hierarchy)
• Factory pattern (CCommandFactory)
• Polymorphism (all commands extend CCommand)
• Parent-child references for error handling

3. Configuration Management ⭐⭐⭐⭐

• 167-line settings.php with all game balance variables
• Global configuration ($GLOBALS superglobal)
• Easy to tune gameplay without code changes

4. Database Abstraction ⭐⭐⭐

• PEAR DB instead of raw mysql_* (better than most games)
• Centralized DSN configuration
• Error checking with DB::isError()

5. Code Organization ⭐⭐⭐⭐

• Consistent naming (C prefix, Cmd suffix)
• One class per file
• Separation of concerns (commands, templates, config)

6. Template Separation ⭐⭐⭐

• 45 HTML templates separate from PHP logic
• Clean MVC-like separation

Weaknesses:

1. No Input Sanitization

• Zero uses of htmlspecialchars() found
• SQL injection risk (PEAR DB doesn't auto-escape)
• XSS vulnerabilities likely

2. Hungarian Notation ⚠️

• Variable names like $m_sPlayerName, $g_DBUsername
• Outdated style (from C++ era)
• Makes code verbose

3. No Documentation

• Zero inline comments
• No PHPDoc blocks
• Function parameters undocumented

4. Global Variables ⚠️

• Heavy use of $GLOBALS superglobal
• Makes testing difficult

5. No Error Logging

• Errors echoed to screen (information leakage)
• No log files for debugging

6. No Tests

• No unit tests
• No integration tests

Modernization Cost: 120-160 hours ($9K-$12K at $75/hr) - surprisingly low because architecture is already good!

Required Changes:

• Replace PEAR DB with PDO (40 hours)
• Add input sanitization/validation (30 hours)
• Implement proper password hashing (10 hours)
• Add PHPDoc documentation (20 hours)
• Write unit tests for command pattern (30 hours)
• Refactor globals to dependency injection (20 hours)

---

PHP Version: Unknown (likely PHP 4/5 based on PEAR DB usage)

PEAR DB: Deprecated since 2008 (replaced by PDO in PHP 5.1+)

Database: Raw SQL queries (no ORM)

Critical Issues:

• PEAR DB removed from modern PHP - requires manual installation
• No prepared statements in code examined - SQL injection risk
• No password hashing visible - likely storing plaintext!
• No framework - custom MVC-like implementation

Missing Modern Features: Namespaces, autoloading, Composer, PDO, password_hash(), type hints, strict typing, PSR standards, ORM, templating engine.

Positive Notes:

• Command pattern = timeless design (still taught in CS courses)
• OOP architecture = forward-thinking for browser game era
• Configuration management = better than 90% of analyzed games

---

Critical Flaws:

1. SQL Injection - 10/10 Severity 🔥🔥🔥

Evidence (CCreateNeighborhoodCmd.php lines 25-28):

$query = "INSERT INTO " . $GLOBALS['g_DBTable']
       . " (PlayerName, NeighborhoodName, Password, LastTurnCredited) VALUES ( '"
       . $sPlayerName . "', '" . $sNeighborhoodName . "', '"
       . $sPassword . "', NOW())";
      $result = $db->Query($query);
      

Impact: Direct string concatenation, PEAR DB doesn't auto-escape. Attacker can:

PlayerName: admin' OR '1'='1

NeighborhoodName: x'); DROP TABLE neighborhoods; --

2. Plaintext Passwords - 10/10 Severity 🔥🔥🔥 Evidence: Database schema shows Password CHAR(64), code shows direct insert of $sPassword variable. No hashing observed anywhere. Passwords stored in plain text, trivially compromised. 3. XSS Vulnerabilities - 9/10 Severity 🔥🔥

• Zero uses of htmlspecialchars() found
• 45 HTML templates likely echo user input directly
• Attacker can inject JavaScript in NeighborhoodName field

4. No CSRF Protection - 7/10 Severity 🔥

• No tokens observed in command system
• Forms vulnerable to cross-site request forgery

5. Hardcoded Database Credentials - 8/10 Severity 🔥🔥

Evidence (settings.php lines 3-4):

$g_DBUsername = "root";
$g_DBPassword = "";  // Empty root password!

Root access with no password = development-only setup, catastrophic if deployed.

6. Information Disclosure - 6/10 Severity 🔥 Commands echo errors directly: echo "An error occurred: $Error";

Database errors exposed to users.

7. Session Hijacking Risk - 6/10 Severity 🔥

• PHP sessions with no visible HTTPOnly/Secure flags
• No session regeneration on login observed

Positive Security Notes:

1. Command Rollback ⭐

• Interrupted commands rolled back automatically
• Prevents partial state corruption
• Transaction-like behavior

2. Error Handling Hierarchy ⭐

• Errors propagate up command chain
• Centralized error handling
• Better than die() everywhere

3. Database Abstraction ⭐

• PEAR DB = layer between code and raw SQL
• Easier to add prepared statements than mysql_*

Security Grade: F+ (3/10) - Good architecture foundation, catastrophic security implementation.

---

THIS IS ONE OF THE BEST-DESIGNED GAMES IN THE COLLECTION!

Innovative Aspects:

1. Command Pattern with Rollback ⭐⭐⭐⭐⭐

• Industry-standard design pattern properly implemented
• Transaction-like rollback for interrupted commands
• Sub-command chaining
• Unique in browser games - most use spaghetti code
• Innovation: 10/10 (extremely rare for browser RPGs)

2. Single-Table Architecture ⭐⭐⭐⭐

• Entire game state in ONE table (18 columns)
• Blazing fast (no JOINs, no foreign keys needed)
• Simple to understand and maintain
• Tradeoff: Limited scalability, but perfect for scope
• Innovation: 8/10 (unconventional but brilliant for small games)

3. Comprehensive Configuration System ⭐⭐⭐⭐

• 167 lines of tunable game balance variables
• Every formula exposed (success rates, costs, loot percentages)
• Game designers can iterate without coding
• Innovation: 7/10 (good practice, not unique)

4. Humorous Theme ⭐⭐⭐

• Kids doing "crimes" (lawn mowing, lemonade, cookies)
• Bullies and paper boys instead of gangsters
• Water balloons instead of guns
• Creative and family-friendly
• Innovation: 8/10 (unique parody angle)

5. Time-Based Turn System ⭐⭐⭐

• Auto-credit turns every 10 minutes
• Max turn bank (1,000)
• LastTurnCredited DATETIME prevents exploits
• Standard: Common in browser games but well-implemented

6. Factory Pattern ⭐⭐⭐

• CCommandFactory creates commands dynamically
• Centralized object creation
• Easy to add new commands
• Innovation: 7/10 (proper OOP)

Technical Merit:

Architecture Quality: 9/10 ⭐⭐⭐⭐⭐

• Textbook command pattern implementation
• Proper OOP encapsulation
• MVC-like separation (CGame = controller, templates = views, CNeighborhood = model)
• Best architecture of any game analyzed so far (yes, even better than ezRPG/Glory Lands in pure design!)

Code Clarity: 7/10

• Clean class structure
• Consistent naming (despite Hungarian notation)
• Easy to understand flow
• Weakened by lack of comments

Maintainability: 8/10

• Easy to add new commands (just extend CCommand)
• Easy to tune balance (edit settings.php)
• Single table = simple schema changes
• Hungarian notation slightly reduces readability

Scalability: 6/10

• Single table = fast for < 10K players
• PEAR DB = potential bottleneck
• No caching layer
• Global state makes horizontal scaling difficult

Historical Context:

Browser Game Architecture Evolution:

• 2000-2005: Spaghetti PHP (no OOP)
• 2005-2008: Basic OOP (classes for models only)
• 2008-2010: Design patterns emerge (MVC, Active Record)
• Kiddie Kartel: Advanced design patterns (Command, Factory) - ahead of its time!

Comparison to Other Games:

Game	Architecture	Design Patterns	Code Quality
Kiddie Kartel	9/10	Command, Factory	8/10
ezRPG	9/10	MVC, ORM-like	9/10
Glory Lands	9/10	GUID, Templates	9/10
Phaos	7/10	OOP character	5/10
ikariam	6/10	OOP classes	5/10

Verdict: Kiddie Kartel has the cleanest architecture despite security flaws. This is professional-grade design with amateur security.

---

Use Case Assessment:

NOT Recommended:

• Production Use - Catastrophic security (plaintext passwords, SQL injection, XSS)
• Public Deployment - Would be hacked in seconds
• Learning Security - Teaches dangerous patterns (no input sanitization)

HIGHLY Recommended:

1. Learning Software Design ⭐⭐⭐⭐⭐

• Perfect example of command pattern in web context
• Shows how to implement rollback transactions in stateless HTTP
• Factory pattern for dynamic object creation
• Use Case: CS courses on design patterns, software architecture classes
• Target: Intermediate to advanced developers

2. Game Architecture Study ⭐⭐⭐⭐⭐

• Single-table optimization technique
• Configuration-driven game balance
• Turn-based mechanics with time regeneration
• Use Case: Game design students, indie game developers
• This is a masterclass in simplicity

3. Refactoring Exercise ⭐⭐⭐⭐

• Perfect candidate for "security hardening" workshop
• Good bones, bad security = ideal learning scenario
• Students add PDO, password_hash(), input sanitization
• Use Case: Security training, refactoring bootcamps
• Estimated effort: 120-160 hours (manageable project)

4. Parody Game Inspiration ⭐⭐⭐

• Kid-friendly mafia game concept
• Lawn mowing > drug dealing, cookies > guns
• Use Case: Game designers seeking family-friendly alternatives to violent themes

Preservation Recommendation:

Archive Status: TIER 1 - DESIGN PATTERN CROWN JEWEL ⭐⭐⭐⭐⭐

Rationale:

• Best Architecture: Command pattern with rollback = textbook implementation
• Educational Value: Perfect teaching example for OOP design patterns
• Unique Approach: Single-table optimization, configuration-driven balance
• Clean Code: Well-organized despite security flaws
• Novel Theme: Humorous kid crime parody (creative!)

Preservation Actions:

Document Architecture (this analysis emphasizes design patterns)

Create Class Diagrams (show command hierarchy, factory relationships)

Extract Design Lessons (single-table pros/cons, rollback mechanism)

Archive Complete Source (70 PHP, 45 HTML templates)

Security Case Study (good design + bad security = learning opportunity)

Comparison Analysis (vs ezRPG/Glory Lands architecture differences)

Modernization Guide (if someone wants to fix it):

• Week 1: Replace PEAR DB with PDO + prepared statements (40 hours)
• Week 2: Add password_hash(), input sanitization, CSRF tokens (40 hours)
• Week 3: Write unit tests for command pattern (30 hours)
• Week 4: Add PHPDoc, refactor globals, deploy (20 hours)

Total: 130 hours = $9,750 at $75/hr

Result: Production-ready game with excellent architecture AND security.

Comparison to Collection:

Top 5 Games by Architecture:

• Kiddie Kartel - 9/10 (command pattern, rollback, factory)
• ezRPG - 9/10 (ORM-like, modular, plugin system)
• Glory Lands - 9/10 (GUID system, templates, visual editors)
• Phaos - 7/10 (OOP character, NPC AI)
• elymantea - 7/10 (custom OPT template engine)

Top 5 Games by Educational Value:

• Kiddie Kartel - Design patterns
• ezRPG - Framework architecture
• Glory Lands - Professional MMORPG engine
• Phaos - Web game history
• grand_theft_auto - Security anti-patterns

Top 5 Games by Innovation:

• ezRPG - 9/10
• Glory Lands - 9/10
• Kiddie Kartel - 9/10 ⭐ NEW ENTRY!
• elymantea - 7/10
• Phaos - 7/10

---

Metric	Value
Files	117 (70 PHP, 45 HTML, 1 JPG, 1 TXT)
Database	1 table (18 columns, single-table design)
Code Size	~5,000 lines (estimated)
Architecture	Command Pattern + Factory Pattern
Database Layer	PEAR DB (deprecated)
	None found (proprietary)
Security	3/10 (SQL injection, plaintext passwords, XSS)
Innovation	9/10 (command pattern, rollback, single-table)
Architecture Quality	9/10 ⭐⭐⭐⭐⭐
Code Quality	8/10 (excellent structure, no docs/tests)
Modernization	$9K-$12K (120-160 hours)
Educational Value	⭐⭐⭐⭐⭐ (design pattern masterclass)
Preservation	Tier 1 - Design Pattern Crown Jewel

Key Strengths: Best architecture in collection, command pattern with rollback, factory pattern, single-table optimization, configuration-driven balance, humorous theme

Key Weaknesses: Plaintext passwords, SQL injection, XSS vulnerabilities, no input sanitization, PEAR DB deprecated

Best Use: Teaching design patterns, game architecture study, refactoring exercise, CS coursework

Unique Feature: Transaction-like command rollback in stateless HTTP context

Historical Significance: Demonstrates how to do OOP design RIGHT in browser games, even if security was neglected. This is the game to study for software architecture, not security.

---