Night

Title: Night (also "Desert Life")

Subtitle: Nightwar (database prefix: nightw_)

Genre: Browser-Based Russian Crime/Gang RPG

Release Date: ~2006 (SQL dumps dated May 20, 2006)

Version: Unknown (no version file)

Developer: Unknown (no credits found)

Language: Russian (Windows-1251 encoding)

Website: Unknown (no references found)

License: Unknown (no license file)

Project Status: Incomplete/Beta (duplicate files suggest active development)

Archive Structure:

`

night/

└── Night/

├── index.php # Splash/login page

├── login.php # Login handler

├── reg.php # Registration (367 lines)

├── pers.php # Player dashboard

├── btl.php # 1v1 PvP battle system (408 lines)

├── g_btl.php # Group battle system (487 lines!)

├── func/

│ ├── hosts.dco # DATABASE CREDENTIALS (plaintext!)

│ ├── func.dco # Core functions

│ └── *.dco # 8 encrypted/obfuscated files

├── btl.sql # Battle database (379 lines)

├── geo.sql # Main game database (1,047 lines)

├── log.sql # Log database (217 lines)

├── casino/ # Gambling system

├── chat/ # Chat system

├── police/ # Police/prison system

├── scr/ # Scripts

├── mda/ # Unknown

├── img/ # 54 GIF + 1 JPG images

├── night.zip # Self-contained backup

├── Копия func/ # Backup copy (Russian: "Copy of func")

├── Копия reg.php # Backup reg.php (350 lines)

└── Новая папка/ # Empty folder (Russian: "New Folder")

`

Historical Context:

Night/Desert Life is a Russian browser-based crime RPG from 2006, representing the Eastern European underground gaming scene. Unlike Western mafia games (MCCodes, Mob Star), Russian browser games had unique characteristics:

• Cyrillic encoding (Windows-1251) - not UTF-8
• Gang warfare focus (клан = klan = gang, not mafia families)
• PvP combat emphasis (elaborate turn-based battle systems)
• Real-time battles (timed combat rounds, not instant resolution)
• Desert/post-apocalyptic theme (not urban crime)

Cultural Note: The game's dual naming ("Night" in English, "Desert Life" in page titles) suggests an attempt to appeal to international audiences while maintaining Russian codebase.

Development Status:

The presence of duplicate files ("Копия func/", "Копия reg.php") and an empty "Новая папка" folder suggests active development when archived. The .dco file extension (Digital Certificate Object? Custom encoding?) indicates code obfuscation or encryption to protect intellectual property.

---

Core Technologies

• Backend: PHP 5.x (uses mysql_* functions)
• Database: MySQL 4.1.8 (three separate databases!)
• Frontend: HTML + CSS + JavaScript
• Encoding: Windows-1251 (Cyrillic)
• Session Management: Cookie-based (c_pass, c_uin, l_u)
• Password Hashing: Custom crypt() function

Multi-Database Architecture

Three Separate Databases:

`

nightw_geo - Main game data (users, items, gangs, real estate)

nightw_btl - Battle system (combat state, battle requests)

nightw_log - Activity logs (crimes, battles, gang actions)

`

Unique Architecture: Most games use single database; Night splits data by functional domain.

Database Credentials (func/hosts.dco - EXPOSED!):

`php

$sql_host = 'localhost';

$sql_login = 'nightw_geo'; // Database username = database name!

$sql_pass = 'asdfa2'; // WEAK PASSWORD!

?>

`

Security Issue: Password stored in plaintext, weak password ("asdfa2").

Cookie-Based Authentication

login.php (Lines 41-49):

`php

// Custom hash function using crypt()

function hesh ($pass) {

$b = strrev ($pass); // Reverse password

$a = crypt ($pass, "00.$b"); // Crypt with salt "00" + reversed pass

return $a;

}

// Store in cookies

SetCookie("c_pass", $pass); // Hashed password

SetCookie("c_uin", $row['uin']); // User ID

SetCookie("l_u", $row['uin'], 9999999999); // Persistent login

`

Auth Check Pattern (pers.php:4):

`php

if (isset($c_pass)&&isset($row['pass'])&&$c_pass==$pass):

`

Better than plaintext (Mob Star), worse than sessions (NEAB Explorer).

Obfuscated .dco Files

func/ directory contains 8 .dco files:

`

func.dco - Core functions

hosts.dco - Database credentials (plaintext!)

get_f_uin.dco - User info retrieval

job_end.dco - Job completion

lvl.dco - Level calculations

lvl_d.dco - Skill level display

lvl_p.dco - Player level display

`

.dco = Digital Certificate Object? Custom encoding?

Some .dco files are plaintext PHP (hosts.dco), others may be encoded/obfuscated. This suggests protection mechanism to hide core game logic from theft.

Code Statistics

• Total Files: 170 files, 1.01 MB
• PHP Files: 76 files, 10,719 lines
• SQL Files: 3 files (btl.sql, geo.sql, log.sql)
• Images: 54 GIF + 1 JPG (0.19 MB)
• Encoding: Windows-1251 (Cyrillic Russian)
• .dco Files: 14 files (8 in func/, 6 in Копия func/)

Largest PHP Files

File	Lines	Purpose
g_btl.php	487	Group battle system (clan wars)
klan.php	426	Gang management
community.php	415	Corporation management
info_realty.php	388	Real estate information
info.php	375	Player information
police.php	364	Police/prison system
reg.php	367	Registration
btl.php	408	1v1 PvP battle (turn-based)
pers_items.php	335	Inventory management

Average file size: 141 lines per PHP file (decent modularity).

---

Core Systems

1. Three-Database Structure

nightw_geo (Main Game):

`sql

uin - Users table

item - Item definitions

item_p - Player inventory

klans - Gangs (клан = klan)

klans_p - Gang membership

realty - Real estate ownership

casino - Casino jackpot tracking

forum - Forum posts

chat - Chat messages

mail - Mail system

ban - IP bans

ip - IP tracking (multi-account detection)

`

nightw_btl (Battle System):

`sql

b - Battle requests/lobby

b_ - Active battle state

chat - Battle chat

`

nightw_log (Activity Tracking):

`sql

log - Battle participation log

crimes - Crime activity log

klan_log - Gang activity log

money_t - Money transfer log

realty_t - Real estate transaction log

`

2. Player Stats (nightw_geo.uin table)

Primary Stats:

`sql

param_1 - Strength

param_2 - Endurance

param_3 - Agility

param_4 - Intelligence

lev_1 - Combat level

lev_2 - Intelligence level

lev_3 - Charisma level

lev_4 - Dexterity level

`

Gang Skills:

`sql

gan_lev_1 - Gang skill 1

gan_lev_2 - Gang skill 2

gan_lev_3 - Gang skill 3

gan_lev_4 - Gang skill 4

gan_lev_5 - Gang skill 5

gan_lev_6 - Gang skill 6 (firearms!)

`

Resources:

`sql

money_1 - Cash ($)

money_2 - Premium currency (£)

token_1 - Health points (HP)

token_2 - Unknown (stamina?)

`

3. Battle System (btl.php - 408 lines)

Battle States (btl column):

`php

btl = 0 - Not in battle

btl = 1 - Requesting battle (lobby)

btl = 2 - Waiting for opponent

btl = 3 - Group battle

btl = 11 - Wounded (HP < 75%)

btl = 12 - Unarmed (specific weapons equipped)

btl = 50 - King battle (special event?)

btl > 100 - Active battle (ID = battle number)

`

Battle Flow:

`

Player 1: /btl.php?act=add → Create battle request

Player 2: /btl.php?act=join&id=123 → Join battle

System: → Lock tables, initialize battle state

→ Calculate stats: pow (power), mask (armor), rasst (distance)

→ Redirect to /b.php (battle screen)

Player 1/2: → Take turns (turn-based combat)

System: → Update HP, calculate damage

→ Winner determined, rewards distributed

`

Distance-Based Combat:

`php

// btl.php:95-101

if ($uins[1]==1) {

$rasst = 50 - floor($rasst/2); // Attacker closer

} else {

$rasst = 50 + floor($rasst/2); // Defender farther

}

`

Distance affects hit chance (firearms need gan_lev_6 skill).

4. Group Battle System (g_btl.php - 487 lines!)

Request Parameters:

`php

$min_l - Minimum level

$max_l - Maximum level

$max_p - Maximum players

$l_min - Enemy min level

$l_max - Enemy max level

$p_max - Enemy max players

$time - Battle duration (5-30 minutes)

$r - Unknown (round-based?)

$klan - Gang ID (only gang members can join)

$klan_e - Enemy gang ID

$info - Battle description (35 chars max)

`

Validation:

`php

if ($max_p>0 && $max_p<11 && // 1-10 players per side

$max_l>0 && $max_l<26 && // Level 1-25

$min_l>0 && $min_l<26 &&

$time > 4 && $time < 31) { // 5-30 minute battles

// Create group battle

}

`

Gang-Only Battles:

`php

$res = mysql_query("SELECT id, tipe FROM nightw_geo.klans WHERE id = $klan");

if ($tipes['tipe']!=1) $klan=0; // Only type 1 gangs (клан) allowed

`

5. Gang System (klan.php - 426 lines)

Gang Types:

`sql

tipe = 1 - Клан (Klan - gang)

tipe = 2 - Корпорация (Corporation)

tipe = 3 - Unknown (property?)

`

Gang Creation (pers_klans.php):

`php

// Klan/Corporation cost: 50,000$

if ($row['money_1'] >= 50000 && $_POST['tipe'] < 3) {

mysql_query("update nightw_geo.uin set money_1 = money_1 - 50000 where uin = $_COOKIE[c_uin]");

mysql_query("insert into nightw_geo.klans values ('','$_COOKIE[c_uin]','0','123','','$_POST[name]','$_POST[tipe]','0','0')");

}

// Property cost: 15,000$

if ($_POST['tipe'] == 3 && $row['money_1'] >= 15000) {

mysql_query("update nightw_geo.uin set money_1 = money_1 - 15000 where uin = $_COOKIE[c_uin]");

}

`

Gang Refund:

`php

// Sell klan/corporation for 20,000$ (10,000$ loss)

mysql_query("update nightw_geo.uin set money_1 = money_1 + 20000 where uin = $_COOKIE[c_uin]");

// Sell property for 5,000$ (10,000$ loss)

mysql_query("update nightw_geo.uin set money_1 = money_1 + 5000 where uin = $_COOKIE[c_uin]");

`

6. Real Estate System (info_realty.php - 388 lines)

nightw_geo.realty table:

`sql

CREATE TABLE realty (

uin int(11), -- Owner

tipe int(11), -- Type (house, building, etc.)

price int(11), -- Purchase price

name char(50), -- Name

pay int(11), -- Maintenance cost

time_ int(11), -- Last payment time

atak int(11), -- Defense (combat stats?)

klan int(11), -- Gang affiliation

param_1 int(11), -- Stat bonus 1

param_2 int(11), -- Stat bonus 2

param_3 int(11), -- Stat bonus 3

param_4 int(11), -- Stat bonus 4

money int(11) -- Income generated

);

`

Real estate provides:

• Passive income (money column)
• Stat bonuses (param_1-4)
• Gang territory (klan column)
• Combat defense (atak column)

7. Casino System (casino/ directory)

nightw_geo.casino table:

`sql

INSERT INTO casino VALUES (106474); -- Current jackpot: 106,474$

`

Single-row table tracks jackpot. Players gamble, jackpot grows.

8. Police/Prison System (police.php - 364 lines)

Likely features:

• Arrest mechanics
• Jail time
• Escape attempts
• Bounty system

9. Mail System

nightw_geo.mail table:

`sql

CREATE TABLE mail (

id int(11) AUTO_INCREMENT,

to_ int(11), -- Recipient

from_ int(11), -- Sender

subj char(100), -- Subject

msg text, -- Message

time_ int(11), -- Timestamp

r int(1) -- Read flag

);

`

10. Chat System

nightw_geo.chat table:

`sql

CREATE TABLE chat (

nick char(20), -- Username

t char(20), -- Timestamp

id int(11) AUTO_INCREMENT,

room smallint(6), -- Chat room

msg char(255) -- Message

);

`

Multiple chat rooms (room column).

11. Forum System

nightw_geo.forum table:

`sql

CREATE TABLE forum (

id int(11) AUTO_INCREMENT,

to_ int(11),

from_ int(11),

subj char(100),

msg text,

time_ int(11),

r int(1),

cat int(2) -- Category

);

`

Similar to mail but with categories (cat column).

---

Security Score: 3/10 - Poor Security, Cookie Auth Issues

IMPROVEMENTS vs Mob Star:

1. Custom Password Hashing

`php

// login.php:8-13

function hesh ($pass) {

$b = strrev ($pass); // Reverse password

$a = crypt ($pass, "00.$b"); // Use PHP crypt() with salt

return $a;

}

`

Better than plaintext (Mob Star), but weak salt ("00" + reversed password).

2. Input Sanitization (Some)

`php

// reg.php:13-15 - Registration uses htmlspecialchars

$f_log = htmlspecialchars ($f_log, ENT_QUOTES);

$f_pass = htmlspecialchars ($f_pass, ENT_QUOTES);

$f_mail = htmlspecialchars ($f_mail, ENT_QUOTES);

`

Found 20+ instances of htmlspecialchars().

3. mysql_real_escape_string (One Instance)

`php

// g_btl.php:13 & btl.php:13

$ar = mysql_real_escape_string($ar);

`

Only 1 instance found! Rest of codebase uses direct $_GET/$_POST in SQL.

4. IP Tracking

`php

// login.php:29-39

mysql_query("insert into nightw_geo.ip values ('".getenv("REMOTE_ADDR")."', '$row[uin]','$l_u','".time()."')");

`

Tracks user IPs for multi-account detection.

CRITICAL VULNERABILITIES:

1. SQL Injection Epidemic

`php

// pers_klans.php:26 - Direct cookie usage in SQL

$res = mysql_query("select tipe from nightw_geo.klans where uin = $_COOKIE[c_uin] and id = $_GET[id]");

// pers_klans.php:72 - Unescaped cookie

mysql_query("SELECT * FROM nightw_geo.klans_p WHERE nightw_geo.klans_p.uin = $_COOKIE[c_uin] AND ...");

// login.php:21 - Direct POST usage

$result = mysql_query("SELECT pass, uin, btl FROM nightw_geo.uin where nick = '$f_login'");

`

37 instances of unescaped $_GET/$_POST/$_COOKIE found in grep search.

2. Cookie-Based Auth with Weak Hashing

`php

// Cookies store hashed password

SetCookie("c_pass", $pass); // crypt() hash

SetCookie("c_uin", $row['uin']);

`

Issues:

• Cookie manipulation = account hijacking
• crypt() with weak salt ("00" + reversed pass)
• No session management

3. Exposed Database Credentials

`php

// func/hosts.dco (PLAINTEXT!)

$sql_pass = 'asdfa2'; // WEAK PASSWORD!

`

4. No CSRF Protection

• No tokens
• All POST/GET forms vulnerable

5. XSS Still Possible

`php

// pers_klans.php:82 - htmlspecialchars used

echo htmlspecialchars($row['name'], ENT_QUOTES, cp1251);

`

Some protection, but not comprehensive.

6. .dco Obfuscation = Security Through Obscurity

• Doesn't prevent attacks
• Makes auditing difficult
• Custom encoding = unknown vulnerabilities

7. Table Locking Issues

`php

// btl.php:71

mysql_query("LOCK TABLES nightw_geo.uin WRITE, nightw_btl.b WRITE, nightw_btl.b_ WRITE");

// ... operations ...

mysql_query("UNLOCK TABLES");

`

Table locks used for atomicity, but deadlock risk if exception occurs before UNLOCK.

Comparison to Previous Games

Game	Security Score	SQL Injection	Password Storage	Auth Method
Mob Star (41)	1/10	Epidemic	Plaintext cookies	Cookies
Mroczni Rycerze (42)	4/10	Common	MD5 hashed	Sessions
NEAB Explorer (43)	7/10	Mostly prevented	Plaintext	Cookies (plaintext!)
Night (44)	3/10	Epidemic	crypt() weak salt	Cookies

Night is worse than Mroczni Rycerze, better than Mob Star.

---

Code Quality Score: 4/10 - Functional but Messy

STRENGTHS:

1. Multi-Database Architecture

`

nightw_geo - Main game

nightw_btl - Battle system

nightw_log - Activity logs

`

Functional separation (good design pattern).

2. Modular File Structure

`

btl.php - 1v1 battles

g_btl.php - Group battles

klan.php - Gang management

casino/ - Gambling

chat/ - Chat

police/ - Police system

`

Clear separation of concerns.

3. Custom Functions in .dco Files

`php

include ("func/func.dco");

include ("func/lvl.dco");

include ("func/lvl_p.dco");

`

Reusable logic extracted (good practice).

4. Table Locking for Atomicity

`php

mysql_query("LOCK TABLES nightw_geo.uin WRITE, nightw_btl.b WRITE");

// Critical operations

mysql_query("UNLOCK TABLES");

`

Prevents race conditions in battle creation.

5. IP Tracking

`php

mysql_query("insert into nightw_geo.ip values ('".getenv("REMOTE_ADDR")."', '$row[uin]','$l_u','".time()."')");

`

Multi-account detection (anti-cheating).

6. Russian Localization

`php

// index.php:5 - Windows-1251 encoding

`

Proper Cyrillic support.

WEAKNESSES:

1. SQL Injection Everywhere

`php

// No escaping in most queries

mysql_query("SELECT * FROM nightw_geo.klans WHERE uin = $_COOKIE[c_uin]");

`

37+ unescaped user inputs.

2. No Error Handling

`php

$result = mysql_query("SELECT pass, uin, btl FROM nightw_geo.uin where nick = '$f_login'");

// No mysql_error() check, silent failure

`

3. Magic Numbers

`php

if ($row['btl']==50){header ("location: b_king.php");exit;}

if ($row['btl']>100){header ("location: b.php");exit;}

`

What is 50? What is 100? No constants defined.

4. Inconsistent Naming

`php

$f_log - Form login

$f_pass - Form password

$c_uin - Cookie user ID

$c_pass - Cookie password

$sql_host - Database host

`

Mixed naming conventions (f_ vs c_ vs sql_).

5. Commented-Out Code

`php

//if(0

//echo 'Îøèáêà äîñòóïà.'; exit();

//}

`

Dead code should be removed.

6. .dco Obfuscation

• Makes debugging difficult
• Prevents code review
• Custom encoding = vendor lock-in

7. Duplicate Files

`

Копия func/ - Backup directory

Копия reg.php - Backup registration

`

Suggests lack of version control (Git, SVN).

8. Russian Comments Only

`php

// Ðåãèñòðàöèÿ

// Ïðîâåðêà ïàðîëÿ

`

Language barrier for international developers.

---

Database Schema (1,643 lines total across 3 SQL files)

nightw_geo.sql (1,047 lines):

Core Tables:

• uin (users) - 50+ columns!
• item (item definitions) - ID, name, stats, type, gang skill requirement
• item_p (player inventory) - User ID, item ID, slot, durability
• klans (gangs) - ID, owner, name, type, money, stats
• klans_p (gang members) - Gang ID, user ID, rank, stats
• realty (real estate) - Owner, type, price, income, bonuses
• casino (jackpot) - Single row with current jackpot
• chat (messages) - Nick, timestamp, room, message
• forum (posts) - Sender, recipient, subject, message, category
• mail (private messages) - Sender, recipient, subject, message
• ip (IP tracking) - IP address, user ID, linked account, timestamp
• ban (banned IPs) - IP address

nightw_btl.sql (379 lines):

Battle Tables:

• b (battle requests) - ID, creator, settings, constraints, timestamp
• b_ (active battles) - Battle ID, user ID, side, distance, armor, power, turn
• chat (battle chat) - Battle ID, message, timestamp

nightw_log.sql (217 lines):

Log Tables:

• log (battle log) - Battle ID, user ID, side
• crimes (crime log) - User ID, action, timestamp
• klan_log (gang log) - User ID, gang ID, money, action, timestamp
• money_t (money transfers) - Sender, recipient, amount, timestamp
• realty_t (real estate transfers) - User ID, type, timestamp
• bg (error log?) - Multiple columns (a, b, c, d, e, f, g, h, err)

Complex Data Structures

1. uin Table (Users - 50+ columns!)

`sql

CREATE TABLE uin (

-- Identity

uin int(11) AUTO_INCREMENT,

nick char(20),

pass char(200), -- crypt() hash

-- Stats

param_1 int(11), -- Strength

param_2 int(11), -- Endurance

param_3 int(11), -- Agility

param_4 int(11), -- Intelligence

-- Levels

lev_1 int(11), -- Combat level

lev_2 int(11), -- Intelligence level

lev_3 int(11), -- Charisma level

lev_4 int(11), -- Dexterity level

-- Gang Skills

gan_lev_1 int(11),

gan_lev_2 int(11),

gan_lev_3 int(11),

gan_lev_4 int(11),

gan_lev_5 int(11),

gan_lev_6 int(11), -- Firearms skill

-- Resources

money_1 int(11), -- Cash

money_2 int(11), -- Premium currency

token_1 int(11), -- Health points

token_2 int(11),

-- Battle State

btl int(11), -- Battle status (0-100+ values)

-- UI Preferences

ref int(11), -- Refresh rate

css char(20), -- CSS theme (day.css, night.css)

-- Social

sex char(1), -- Gender (m/f)

time_ int(11) -- Last activity timestamp

);

`

Most columns of any game so far (50+ vs 98 in NEAB Explorer).

2. Battle System (btl.php)

Battle Request (nightw_btl.b):

`sql

CREATE TABLE b (

id int(11) AUTO_INCREMENT,

uin int(4), -- Creator

key_ int(1),

side int(1), -- Creator's side (1 or 2)

min_l int(2), -- Min opponent level

max_l int(2), -- Max opponent level

max_p int(2), -- Max players

time int(11), -- Expiration timestamp

l_min int(2), -- Creator min level

l_max int(2), -- Creator max level

p_max int(2), -- Creator max players

info char(100), -- Description

r int(1),

klan int(11), -- Gang restriction

klan_e int(11) -- Enemy gang restriction

);

`

Active Battle (nightw_btl.b_):

`sql

CREATE TABLE b_ (

id int(11), -- Battle ID

uin int(11), -- Player ID

side int(1), -- Team (1 or 2)

rasst int(11), -- Distance (affects hit chance)

mask int(11), -- Armor (damage reduction)

pow int(11), -- Power (damage)

key_ int(11), -- Turn state

uron int(11), -- Damage dealt

exp int(11), -- Experience gained

atak_1 int(11), -- Attack type

hod int(1), -- Turn number

time int(11) -- Turn timeout

);

`

Turn-Based Combat:

• Players join battle → System calculates stats (pow, mask, rasst)
• Turn 1 → Player 1 attacks → Damage = pow - (mask + distance penalty)
• Turn 2 → Player 2 attacks → Same calculation
• Loop until HP <= 0 → Winner determined

3. Gang System

Gang Types:

`sql

tipe = 1 -- Клан (Klan - criminal gang)

tipe = 2 -- Корпорация (Corporation - business gang)

tipe = 3 -- Property (unknown purpose)

`

Gang Membership (nightw_geo.klans_p):

`sql

CREATE TABLE klans_p (

id int(11), -- Gang ID

uin int(11), -- Member ID

rang char(15), -- Rank/role

param_1 int(11), -- Stats contributed

param_2 int(11),

stat int(1), -- Status (active/inactive)

time_ int(11), -- Join time

class int(1), -- Member class

tipe int(11) -- Gang type

);

`

---

Russian Browser Gaming (2005-2007)

Context:

• Western games: MCCodes, Mob Star (English/Dutch)
• Eastern games: Night, Mroczni Rycerze (Russian/Polish)
• Language barriers: Separate ecosystems, no cross-pollination
• Cultural themes: Gangs (клан) vs Mafia families

Russian Gaming Characteristics:

• Cyrillic encoding (Windows-1251, not UTF-8)
• PvP emphasis (complex battle systems)
• Gang warfare (group battles, territory)
• Real-time mechanics (timed turns, not instant)
• Post-apocalyptic themes (Desert Life, not urban crime)

Night Innovations:

• Multi-database architecture (rare for 2006)
• Turn-based PvP (distance-based combat)
• Group battles (10v10 clan wars)
• Real estate system (passive income, stat bonuses)
• Casino gambling (jackpot tracking)

Timeline Position

Pre-Night:

• 2005: Mob Star (English/Dutch) - plaintext passwords, 1/10 security
• 2007: Mroczni Rycerze (Polish) - MD5 hashing, 4/10 security
• 2005-2007: NEAB Explorer (English) - database abstraction, 7/10 security (but plaintext passwords!)

Night (2006):

• Better than: Mob Star (custom hashing vs plaintext)
• Worse than: Mroczni Rycerze (SQL injection epidemic)
• Unique: Multi-database architecture, group battles

Post-Night:

• 2008+: Western mafia games dominate (MCCodes derivatives)
• 2010s: Russian browser gaming continues independently
• 2015+: Mobile gaming kills browser RPG market

Comparison to Contemporaries

vs Mroczni Rycerze (Game 42, 2007, Polish):

Feature	Mroczni Rycerze	Night
Theme	Fantasy knights	Desert crime
Language	Polish	Russian
Codebase	1,781 lines	10,719 lines
Security	4/10	3/10
Databases	1 (4 tables)	3 (50+ tables)
Combat	Simple arena	Turn-based PvP + group battles

vs NEAB Explorer (Game 43, 2005-2007, English):

Feature	NEAB Explorer	Night
Type	Game engine	Standalone game
Codebase	17,035 lines	10,719 lines
Security	7/10 (SQL), 1/10 (passwords)	3/10 (both weak)
Architecture	Database abstraction	Multi-database
Innovation	AJAX 2D maps	Group PvP battles

Lesson: Regional games (Polish, Russian) developed independently from Western games, leading to unique mechanics (turn-based combat, gang systems) but similar security flaws (SQL injection epidemic).

---

External Dependencies

None. Completely self-contained.

PHP Extensions Required

`php

• mysql extension (deprecated, removed PHP 7.0)
• GD library (possibly for images)
• crypt() function (built-in)
• Windows-1251 encoding support

`

Database Requirements

`sql

-- MySQL 4.1.8 or above

-- MyISAM engine (all tables)

-- Three separate databases:

-- nightw_geo (main game)

-- nightw_btl (battles)

-- nightw_log (activity logs)

-- ~500 KB database size (empty)

-- Windows-1251 character set (Cyrillic)

`

Installation Complexity: HIGH

Hypothetical Install Process:

`

• Create 3 MySQL databases:
• nightw_geo
• nightw_btl
• nightw_log
• Import SQL files:
• Import geo.sql → nightw_geo
• Import btl.sql → nightw_btl
• Import log.sql → nightw_log
• Edit func/hosts.dco:
• Set $sql_login (must match database names!)
• Set $sql_pass
• Upload files to web server
• Access index.php
• Register account (reg.php)

`

Pros:

• SQL dumps provided (3 files)
• Database structure documented

Cons:

• No installation guide
• No README
• No default credentials
• Three databases required (complex setup)
• .dco files may need decoding
• Russian-only interface
• Weak database password ("asdfa2")

Deployment Requirements

`

LAMP Stack:

• Linux/Windows server
• Apache (no special config)
• PHP 4.x-5.x (will NOT work on PHP 7.0+)
• MySQL 4.1.8+
• Windows-1251 encoding support
• 3 separate databases

`

Modern Deployment: IMPOSSIBLE without rewrites

• mysql_* functions removed PHP 7.0 → Must rewrite all database calls
• Cookie auth → Must switch to sessions
• SQL injection → Must add escaping everywhere
• crypt() weak salt → Must use bcrypt/Argon2
• .dco files → Must decode/rewrite
• Windows-1251 → Must convert to UTF-8

Estimated rewrite effort: 150-200 hours (medium-large codebase).

---

Completeness Score: 7/10 - Mostly Complete, Missing Docs

What's Present:

• Full source code (76 PHP files, 10,719 lines)
• Database schema (3 SQL files, 1,643 lines)
• Images (54 GIF + 1 JPG)
• CSS stylesheet (day.css)
• Self-contained backup (night.zip)
• Core systems implemented (battles, gangs, real estate, casino, chat, forum, mail)
• .dco function files (8 files)

What's Missing:

• No README
• No installation guide
• No license
• No credits/developer info
• No English translation
• No documentation for .dco files

What's Broken:

• ⚠️ SQL injection vulnerabilities (37+ instances)
• ⚠️ Cookie-based auth (weak)
• ⚠️ Deprecated mysql_* functions (PHP 7.0+ incompatible)
• ⚠️ .dco files may need decoding

Playability Status:

`

Can Install: YES (if 3 databases created, PHP 5.6)

Can Register: YES

Can Login: YES

Can Battle (1v1): YES (btl.php)

Can Battle (Group): YES (g_btl.php)

Can Join Gang: YES

Can Buy Real Estate: YES

Can Chat: YES

Can Run on PHP 7+: NO (requires full rewrite)

`

Cultural Value: MEDIUM-HIGH - Russian Gaming History

Historical Significance:

• Russian browser gaming (unique regional ecosystem)
• Multi-database architecture (advanced for 2006)
• Turn-based PvP (distance-based combat)
• Group battles (10v10 clan wars)
• Windows-1251 encoding (Cyrillic localization)
• Desert/post-apocalyptic theme (not urban crime)

Comparative Rarity:

• Rare: Only Russian game in 44-game collection
• Unique: Multi-database architecture
• Unique: Turn-based PvP with distance mechanics
• Common: PHP/MySQL stack
• Rare: .dco file obfuscation

In Wild:

• No website references found
• "Nightwar" search yields unrelated results
• "Desert Life" too generic
• Estimated copies worldwide: <20 (very rare)

Restoration Difficulty: HIGH

To Run on PHP 5.6:

`

Effort: MEDIUM (16-24 hours)

• Create 3 databases
• Import 3 SQL files
• Edit func/hosts.dco with credentials
• Decode .dco files (if encoded)
• Test all features

`

To Run on PHP 7.x+:

`

Effort: HIGH (150-200 hours)

• Replace ALL mysql_* with mysqli/PDO (76 files!)
• Add SQL injection prevention (37+ locations)
• Fix crypt() implementation (use bcrypt)
• Switch cookie auth to sessions
• Convert Windows-1251 to UTF-8
• Decode/rewrite .dco files
• Test 3-database architecture
• Test battle system (turn-based logic)

`

To Translate to English:

`

Effort: MEDIUM (40-60 hours)

• Translate all UI text (Russian → English)
• Translate database content (gang names, item names)
• Convert Windows-1251 → UTF-8
• Translate comments (code documentation)

`

Comparative Rarity

In This Collection (Games 1-44):

• Unique: Only Russian-language game
• Unique: Multi-database architecture (3 databases)
• Unique: Turn-based PvP with distance mechanics
• Rare: Group battle system (10v10)
• Common: PHP/MySQL stack
• Unique: .dco file obfuscation

In Wild:

• Extremely Rare: <20 estimated copies
• Lost: No website/community found
• Undocumented: No preservation efforts
• Language Barrier: Russian-only limits discovery

---

Overall Rating: 5/10 - Ambitious Design, Poor Execution

RATING BREAKDOWN:

Category	Score	Reasoning
Security	3/10	Cookie auth, SQL injection epidemic, weak password hashing
Code Quality	4/10	Modular structure, but messy code, no error handling
Completeness	7/10	Core features implemented, but missing documentation
Innovation	7/10	Multi-database architecture, turn-based PvP, group battles
Playability	6/10	Works on PHP 5.6, broken on PHP 7+
Historical Impact	5/10	Regional significance (Russian gaming), zero international impact
Preservation Value	7/10	Only Russian game in 79-game collection

STRENGTHS:

• Multi-Database Architecture
• nightw_geo (main game)
• nightw_btl (battle system)
• nightw_log (activity logs)
• Functional separation (advanced for 2006)

• Turn-Based PvP Combat
• Distance-based mechanics (rasst = distance)
• Stat calculations (pow, mask)
• Turn timeouts
• More sophisticated than instant-resolution (most games)

• Group Battle System
• 10v10 clan wars
• Level restrictions
• Gang-only battles
• Timed battles (5-30 minutes)
• 487-line g_btl.php (largest file)

• Real Estate System
• Passive income
• Stat bonuses
• Gang territory
• Maintenance costs

• Russian Localization
• Windows-1251 encoding
• Cyrillic throughout
• Cultural themes (gangs, desert, post-apocalyptic)

• IP Tracking
• Multi-account detection
• Cheat prevention

WEAKNESSES:

• SQL Injection Epidemic
• 37+ unescaped $_GET/$_POST/$_COOKIE
• Only 1 mysql_real_escape_string() usage
• Direct user input in queries

• Cookie-Based Auth
• Should use sessions
• Weak crypt() salt ("00" + reversed password)
• Cookie manipulation = account hijacking

• Exposed Database Credentials
• func/hosts.dco plaintext
• Weak password ("asdfa2")

• No CSRF Protection
• All forms vulnerable

• .dco File Obfuscation
• Security through obscurity
• Makes auditing difficult
• May prevent restoration

• Deprecated PHP
• mysql_* functions (removed PHP 7.0)
• Won't run on modern PHP

• No Documentation
• No README
• No installation guide
• Russian-only

• Duplicate Files
• "Копия func/", "Копия reg.php"
• Suggests no version control

Tier Classification: TIER 3 - Ambitious Regional Game

Comparison to Collection:

• Better than: Mob Star (41) - custom hashing vs plaintext
• Equal to: Mroczni Rycerze (42) - similar security, regional focus
• Worse than: NEAB Explorer (43) - SQL injection prevention
• Unique: Only Russian game in 79-game collection

Preservation Priority: HIGH

Justification:

• Cultural Uniqueness: Only Russian-language browser RPG in collection
• Regional Gaming History: Documents Eastern European underground gaming scene
• Technical Innovation: Multi-database architecture (rare for 2006)
• Combat System: Turn-based PvP with distance mechanics (unique)
• Extreme Rarity: <20 copies estimated, no online presence
• Language Preservation: Russian gaming terminology and themes

Ideal Use Cases (2024)

Educational Value:

• Regional Gaming Study: Russian browser gaming vs Western
• Multi-Database Architecture: Functional separation patterns
• Combat System Design: Turn-based mechanics, distance calculations
• Security Anti-Patterns: SQL injection epidemic case study
• ⚠️ Code Obfuscation: .dco files (limited educational value)

Historical Research:

• Eastern European Gaming: Russian browser gaming 2005-2007
• Language Barriers: How regional markets developed independently
• Cultural Themes: Desert/post-apocalyptic vs urban crime
• Gang Systems: Клан (klan) vs Mafia families

Restoration Projects:

• ⚠️ High Effort: 150-200 hours for PHP 7+ compatibility
• ⚠️ Translation Required: 40-60 hours for English version
• Cultural Preservation: Document Russian gaming history

The Night Story

Night/Desert Life represents Russian browser gaming in 2006:

• 2006: Unknown Russian developer creates "Nightwar"
• Theme: Desert post-apocalyptic gang warfare (not urban mafia)
• Innovation: Multi-database architecture (nightw_geo, nightw_btl, nightw_log)
• Combat: Turn-based PvP with distance mechanics (unique)
• Language: Pure Russian (Windows-1251 encoding)
• Protection: .dco file obfuscation (anti-theft)
• Security Flaw: SQL injection epidemic, cookie auth
• 2010?: Game goes offline, no community preservation
• 2024: Discovered in archive, recognized as Russian gaming artifact

The Lesson: Regional browser games existed in parallel to Western hits, developing unique mechanics (turn-based PvP, group battles, real estate systems) but suffering similar security flaws (SQL injection, weak auth). The language barrier created isolated ecosystems—Russian games never influenced Western games, and vice versa. The .dco obfuscation shows paranoia about code theft in underground gaming scenes.

The Innovation: Multi-database architecture (3 databases for functional separation) was advanced for 2006 when most games used single databases. The turn-based PvP with distance mechanics (firearms require closer range, melee requires engagement) shows sophisticated combat design beyond simple stat comparisons.

Final Assessment

Technical Quality: ⚖️ Mid-tier (multi-database architecture, turn-based combat)

Security Quality: ⚠️ Poor (SQL injection epidemic, cookie auth, weak hashing)

Cultural Value: 🏆 HIGH (only Russian game, regional gaming history)

Playability: Functional (PHP 5.6), 💥 Broken (PHP 7+)

Recommendation: PRESERVE as regional gaming artifact. Night is the only Russian-language browser RPG in this 79-game collection, documenting the Eastern European underground gaming scene circa 2006. The multi-database architecture and turn-based PvP system show technical ambition beyond typical hobbyist projects. However, the SQL injection epidemic (37+ unescaped inputs) and cookie-based auth with weak hashing make it completely insecure. The .dco file obfuscation reflects code theft paranoia in regional gaming scenes. With <20 estimated copies worldwide and no online presence, this is a critical cultural artifact requiring preservation despite security flaws.

CRITICAL WARNING: Never deploy in production without rewriting security (SQL injection everywhere, cookie auth vulnerabilities). The weak database password ("asdfa2") in func/hosts.dco is a catastrophic exposure. .dco files may contain additional vulnerabilities if obfuscation is decoded. This game is historical/educational, not production-ready.

---

Archive Status: PRESERVED

Analysis Date: December 11, 2025

Game Number: 44 of 79

Analyst Notes: This is the first Russian-language game in the collection (games 1-44 were English/Dutch/Polish). Night represents Eastern European underground gaming with unique mechanics: multi-database architecture (nightw_geo, nightw_btl, nightw_log), turn-based PvP with distance-based combat, and group battles (10v10 clan wars). The .dco file obfuscation shows code protection paranoia. SQL injection epidemic (37+ unescaped inputs) and cookie-based auth with weak crypt() salt make it insecure. Windows-1251 encoding (Cyrillic). Duplicate files ("Копия func/", "Копия reg.php") suggest active development when archived. With <20 estimated copies worldwide and no online presence, this is a maximum-priority preservation artifact documenting Russian browser gaming history.