Robot Warz

Game Name: Robot Warz

Version: Unknown (database dated 2007-10-21)

Genre: Web-based RPG robot battle game

Developer: Unknown (contact: This email address is being protected from spambots. You need JavaScript enabled to view it.)

Language: Russian (windows-1251 charset)

Technology: PHP + MySQL

Server: http://robotwarz.ru

License: Likely commercial/proprietary

Release Era: ~2007-2008

Database Date: 2007-10-21 (from SQL dump filename)

---

Total Files: 1,195

File Breakdown:

• PHP: 118 files (1,169,660 bytes) - 23,307 lines
• GIF: 900 files (5.63 MB) - EXTENSIVE graphics
• JPG: 98 files (3.90 MB)
• HTML: 32 files (69,643 bytes)
• INC: 29 files (99,982 bytes) - Include files
• CSS: 6 files (15,041 bytes)
• JS: 4 files (24,056 bytes)
• HTM: 4 files (5,242 bytes)
• SQL: 1 file (170,976 bytes)
• ICO: 1 file (3,262 bytes)
• HTACCESS: 1 file (54 bytes)
• OLD: 1 file (4,985 bytes)

Total Size: ~11.7 MB (5.6 MB graphics!)

Key Directories:

• / - 118 PHP game files (flat structure)
• /modules/ - 17 function modules
• /help/ - Help documentation
• /css/ - Stylesheets
• /js/ - JavaScript
• /labirint/, /labirint2/ - Maze minigame
• /forest/ - Forest gathering minigame
• /exchange/ - Trading system
• /logs/ - Battle logs
• /usersimage/ - User uploads
• /test/ - Testing files

---

3.1 Technology Stack

PHP Architecture:

• PHP 5.x compatible (windows-1251 encoding)
• Session-based authentication
• MySQL database with custom abstraction layer
• Modular function system (17 modules)
• Frame-based UI (frameset layout!)
• Real-time features (delayed inserts for chat)

Database Configuration (inc_config_db.php):

`php

$user='ru-robotwarz';

$pass='f8157afbec';

$host='80.93.49.170';

$baza='ru-robotwarz';

$httpServer='http://robotwarz.ru';

$httpPrefix='/';

$imgPath='usersimage/';

`

NOTE: Hardcoded production credentials exposed!

3.2 Bootstrap System

lib.php (Core Loader):

`php

require('inc_config_db.php');

$db=mysql_connect($host,$user,$pass) or die('Server Error');

mysql_select_db($baza,$db);

mysql_query('SET names cp1251');

// Load all system variables from config table

$vars=mysql_query('select var, val from config');

while($vr=mysql_fetch_array($vars)) $$vr['var']=$vr['val'];

// Dynamic module loading

$handle=opendir($path.'modules');

while(false!==($file=readdir($handle)))

if(eregi("function.php$",$file)) include($path.'modules/'.$file);

closedir($handle);

`

Dynamic Variable Injection: Uses $$var to create global variables from database!

3.3 Module System

17 Modules (modules/ directory):

• admin_function.php - Admin tools
• battle_function.php - Combat system
• canalization_mod.php - Sewer minigame
• chat_function.php - Chat system
• constant_function.php - Constants
• exchange_function.php - Trading
• fish_probability.php - Fishing mechanics
• forest_probability.php - Foraging mechanics
• ftp_function.php - FTP operations (!)
• log_function.php - Logging
• mail_function.php - Messaging
• main_function.php - Core utilities
• misc_function.php - Miscellaneous
• movie_function.php - Battle replay
• room_function.php - Location management
• travma_function.php - Injury system

3.4 Database Schema

40+ Tables (ru-robotwarz_2007-10-21_02-32.sql):

Core Tables:

• users - Player accounts (70+ fields!)
• accounts - Multi-character system
• config - System variables
• content - CMS content

Combat System:

• battle_request - Battle matchmaking
• battle_movie - Turn-by-turn replay data
• user_in_battle - Active combatants
• attacklogs - Historical logs

Item System (Comprehensive!):

• item - Actual items (2.4M+ IDs!)
• item_prototype - Item templates (465 prototypes)
• item_group - Equipment categories (17 groups)
• gosshop - Government shop inventory
• comission - Consignment shop
• inventory - Player items (via users_bags)
• users_bags - Equipped items

Clans:

• clan - Guild system
• clan_permission - Permissions
• clan_weapon - Shared weapons

Locations:

• built - Player buildings
• forest - Foraging data (25 resource types!)

Chat/Communication:

• chat_private - Private messages
• sms - System messages
• message_log - Chat history

Economy:

• game - Player-owned gambling
• gosshop - NPC shop inventory
• comission - Player market
• crystal_market (implied)

Minigames:

• labirint - Maze game
• expire - Level exp tables

Moderation:

• bad_boys - Punishments
• alog - Admin logs
• slog - System logs

3.5 Authentication System

Session-Based:

`php

// action.php login

if(strcmp(md5($_POST['pass']),$r['passw'])==0 and $r['status']==ENABLED) {

session_start();

session_register('login','pass','startTime','current_user_ip');

$_SESSION['login']=$_POST['login'];

$_SESSION['pass']=md5($_POST['pass']); // Stores hashed password

$_SESSION['startTime']=time();

$_SESSION['current_user_ip']=USER_IP;

mysql_query('update users set sesid="'.session_id().'" where id='.$r['id']);

$t='index.php';

}

`

Password Storage: MD5 hashing (no salt)

Access Control (lib.php):

`php

function checkAdmin() {

global $User;

if(!isset($_SESSION['login']) or !isset($_SESSION['pass'])) return false;

// Loads user data into $User global

return true;

}

`

---

4.1 Frame-Based UI

index.php (Frameset Layout):

`html

`

3-Panel Layout: Main game area + Chat/Online + Toolbar

4.2 Core Stats System

User Stats (users table - 70+ fields!):

• sila - Strength (damage)
• lovkost - Agility (dodge/hit)
• inta - Intelligence (magic/tech)
• power - Power level
• mind_power - Mental power
• health/max_health - HP
• level - Character level
• opyt - Experience points
• money - Currency
• wins/lost/advice - W/L/D record

Combat Modifiers:

• mf_krit - Critical hit chance
• mf_uvorot - Dodge chance
• mf_antikrit - Anti-crit
• mf_anti_uvorot - Anti-dodge

4.3 Equipment System (Extensive!)

17 Equipment Slots (item_group):

• ������ (Earrings) - slot 1
• �������� (Necklace) - slot 2
• ����/������� (Axes/Swords) - slot 3 (two-handed)
• ������ (Rifles) - slot 3
• ������/������ (Pistols/Weapons) - slot 3
• ����� (Armor) - slot 4
• ������ (Rings) - slot 5
• ����� (Helmet) - slot 6
• �������� (Gauntlets) - slot 7
• ���� (Shield) - slot 8
• ����� (Boots) - slot 9
• ���������� ������ (Consumables) - slot 0
• ��������� ����� (Special Items) - slot 0
• ������� (Gifts) - slot 11
• ����/����� (Spears/Lances) - slot 3
• ����� (Belt) - slot 10
• ����� (Flowers) - slot 11

465 Item Prototypes:

• Weapons: 50+ types (BFG-9000, swords, axes, rifles, pistols)
• Armor: Full sets (helmet, chest, gauntlets, boots, belt, shield)
• Accessories: Rings, earrings, necklaces
• Magic items: Scrolls, enchantments
• Gifts: 19+ present types
• Consumables: Potions, food

Item Properties (item_prototype):

`php

• req_level, req_power, req_sila, req_lovkost, req_inta
• up_sila, up_lovkost, up_inta (stat bonuses)
• up_mf_krit, up_mf_uvorot, up_mf_antikrit (combat modifiers)
• up_health, up_mind_power
• udar_min, udar_max (weapon damage)
• b1, b2, b3, b4 (block ratings for 4 body zones!)
• durability/max_durability
• magic (magic effect ID)
• mod (modification status: -1 broken, -2 unavailable, 1 upgraded, 2 enchanted)

`

4-Zone Block System:

• b1, b2, b3, b4 represent protection for different body zones
• Complex damage calculation per zone!

4.4 Combat System

PvP Arena (arena.php):

Battle Matchmaking (battle_request):

`php

• battle_type: 0=single, 1=???, 2=???
• timeout: Battle time limit
• hand_only: 1=unarmed only (injury restriction)
• num_cmd1, num_cmd2: Team sizes
• status: 0=waiting, 1=active, 2=finished
• winner: 0=none, 1=team1, 2=team2, 3=draw

`

Turn-Based Combat (battle.php):

Combat Actions:

`php

kick: 0-3 (4 attack zones)

block: 0-3 (4 defense zones)

`

Combat Mechanics (battle_movie):

`php

// Each turn records:

• user_1, user_2 (combatants)
• kick (0-3 body zone attack)
• block (0-3 body zone defense)
• uron (damage dealt)
• step (turn number)
• command (team ID)

`

Combat Calculation:

`php

// battle.php lines 62-88

calculate_item_bonus(&$User);

calculate_item_bonus(&$enemy_data);

$fight_data=calculate_kick_power($User, $enemy_data);

// Damage application

$User['health']-=$fight_data['uron_defender'];

$enemy_data['health']-=$fight_data['uron_attacker'];

`

Battle Outcomes:

• Victory: Gain exp, avoid item damage
• Draw: Half exp, medium item damage
• Loss: No exp, heavy item damage

Item Durability Loss (crash_item):

`php

CRASH_WINNER_ITEM

CRASH_ADV_ITEM

CRASH_LOST_ITEM

// Random item loses durability based on outcome

`

Injury System (travma_function.php):

`php

travma['level']:

• 'light': No restrictions
• 'medium': Hand-only combat
• 'hard': Cannot fight

`

4.5 Multi-Character System

Accounts (account.php):

`php

// Players can create multiple sub-accounts

• atype: Account type
• lod, elod: Experience levels
• owner_id: Main user ID
• passw: MD5 password

`

Account Management:

• Create sub-accounts (3 money fee)
• Switch between characters
• Separate progression per account

4.6 Location System

City Map (main.php):

Locations (image map):

• ������� (Shop) - Buy equipment
• ���� (Temple) - ???
• ����� (Arena) - PvP combat
• ������������� (Administration) - City hall
• ������� (Casino) - Gambling
• �������� ������� (Clan Chamber)
• ����������� (Canalization) - Sewer minigame
• More locations via clickable image map

Room System:

`php

$User['room']: 0=main, 1=arena, 2=shop, etc.

// Updates chat/online frames on location change

`

4.7 Labirint (Maze) Minigame

Maze Exploration (labirint.php, labirint2/):

`php

$User['labirint_hol']: Current maze level/room

// Navigation: rotateleft, rotateright, forward, back

// Exit cost: 5 money if not completed

`

Canalization (canalization.php):

`php

// Similar maze system

in_array($_GET['action'], array('rotateleft','rotateright','forward','back'))

`

4.8 Foraging System

Forest Gathering (forest.php):

25 Resource Types (forest table):

• ������ (Mushrooms): belij_grib, muhomor, lisicka, smorch, siroezka, bledpog, satan, trufel (8 types!)
• ������ (Trees): dub, padub, vishna, beresa, buk, klen, oreshn, rabina (8 types)
• ����� (Plants): zveroboj, kalend, paporot, hmel, landish, fialka, pervozvet, giazint (8 types)
• time: Last gathering time

Foraging Mechanics:

• Time-gated resource collection
• Multiple resource varieties with different values
• Personal inventory per player

4.9 Economy System

Government Shop (shop.php):

`php

gosshop table: 597 items with inventory counts

// NPC shop with limited stock

`

Comission Shop (comission.php):

`php

// Player-to-player market

• item_id: Listed item
• user_id: Seller
• price: Asking price
• start_date: Listing time

`

Clan Weapons (clan_weapons.php):

`php

clan_weapon table:

// Shared clan equipment

• cost: Rental/purchase price
• user_id: Current user (if rented)
• start_date, end_date: Rental period

`

Player Buildings (built table):

`php

// Economic production buildings

• type: Building type
• workers: Employee count
• zarplata: Salary cost
• [resource]_h: Hourly production
• [resource]_all: Total produced
• [resource]_cost: Production cost

Resources: almaz (diamond), ugol (coal), wood, steel, gold, rood

`

Gambling (game table):

`php

mount, glas: Player-owned gambling machines

`

4.10 Chat System

Real-Time Chat (chat.php, room.php):

`php

// Delayed insert for performance

mysql_query('insert delayed into message_log...');

`

Private Messages (chat_private):

`php

// Colored messages with HTML styling

''.$message.''

`

System Messages (sms table):

`php

add_private_system_message($text, $user_name='', $from='System');

`

4.11 Clan System

Clan Features (clan_room.php):

• Clan creation (1 money cost)
• Clan legend (description)
• Clan icon
• Clan homepage URL
• Permission system (9 permissions)
• Shared weapons (clan_weapon)

Clan Permissions (clan_permission):

`php

permission: 1-9 (various privileges)

`

4.12 Administrative Tools

Admin Panel (admin.php):

• User management (staff_users implied)
• Content management (content table)
• Item editing (item prototypes)
• Combat bot management (challengebots table)
• Moderation tools (bad_boys punishments)
• Logs: alog (admin actions), slog (system events)

Punishment System (bad_boys):

`php

• act: Punishment type
• end_time: Expiration
• moderator: Admin who issued
• reason: Violation description

`

4.13 Magic System

Mage Class (mage.php):

`php

// Magic casting system

$message // Spell message

mysql_query('insert delayed into message_log...');

`

Magic Scrolls (item_prototype):

`php

id=236-240:

• "������ ���������" (Scroll of Restoration)
• "������ ������������� � ���" (Scroll of Concentration & Mana)
• "������ ������� ������ ������" (Scroll of Healing Big Damage)
• "������ ������� ������� ������" (Scroll of Healing Medium Damage)
• "������ ������� ����� ������" (Scroll of Healing Small Damage)

magic: 1-6 (effect IDs)

`

4.14 Presents/Gifts System

Gift Items (present01-present19):

`php

// 19+ gift types for social features

• Cost: 5 each
• Transferable between players

`

Flowers (17 flower types):

`php

// Social items (dating/friendship)

• Cost: 20-25 each

`

4.15 Help System

Help Documentation (help/):

• help01.jpg (tutorial image)
• img/ subdirectory
• index.html (help index)

4.16 Status Effects

Status Management (status.php):

`php

// Level-up, item effects, buffs/debuffs

mysql_query('insert delayed into message_log...');

`

---

5.1 Critical Vulnerabilities (4/10)

1. Hardcoded Production Credentials (EXPOSED!):

`php

// inc_config_db.php lines 3-6

$user='ru-robotwarz';

$pass='f8157afbec';

$host='80.93.49.170';

$baza='ru-robotwarz';

`

• Database credentials in source code
• FTP credentials also exposed (ftpPass='KBgjDD90')
• Severity: 10/10 - Complete database compromise

2. Dynamic Variable Injection:

`php

// lib.php lines 10-11

$vars=mysql_query('select var, val from config');

while($vr=mysql_fetch_array($vars)) $$vr['var']=$vr['val'];

`

• Creates global variables from database
• Database compromise → arbitrary PHP variables
• Severity: 8/10

3. SQL Injection (WIDESPREAD):

`php

// Battle.php line 57 (no validation!)

$enemy_id=(int)$_POST['enemy_id'];

// action.php lines 35-36

$rlogin=stop_sql_injection(prepare_str(trim($_POST['rlogin'])));

// Custom function, but...

// edithome.php line 32

$object=mysql_fetch_array(mysql_query("select * from built where id=".$_GET['obj']));

// Direct $_GET injection!

`

stop_sql_injection() uses custom escaping:

`php

// main_function.php (implied)

function prepare_str($str) {

$s=eregi_replace('"','"',killSlashes($str));

$s=eregi_replace("'",'’',$s);

// HTML entity encoding, NOT SQL escaping!

}

`

• Not using mysql_escape_string() consistently
• Some uses: mysql_escape_string() (13 matches)
• Most queries use string interpolation
• Severity: 9/10

4. MD5 Password Hashing (No Salt):

`php

// action.php lines 15, 19, 79

md5($_POST['pass'])

md5($pass1)

`

• MD5 trivially crackable
• No salt = rainbow table vulnerable
• Session stores hashed password ($_SESSION['pass']!)

5. Deprecated Functions:

`php

session_register('login','pass','startTime','current_user_ip');

eregi() // Removed PHP 5.3+

mysql_connect() // Removed PHP 7.0

`

6. File Upload System:

`php

$imgPath='usersimage/';

// Directory for user uploads (potential path traversal)

`

7. Session Fixation:

• No session_regenerate_id() on login
• Session ID stored in database (sesid field)

5.2 Minor Issues

8. Information Disclosure:

`php

die('Server Error'); // Generic error, but still leaks info

`

9. CSRF Vulnerable:

• No CSRF tokens on forms
• State changes via GET (edithome.php?obj=...)

10. Input Validation (Partially Implemented):

`php

// battle.php lines 61-64 (GOOD!)

if(!in_array((int)$_POST['kick'],array(0,1,2,3)) or

!in_array((int)$_POST['block'],array(0,1,2,3))) {

header('Location: battle.php');

exit;

}

`

5.3 Security Score: 4/10

Rationale:

• Hardcoded credentials = instant 0/10 (but better than extract($_*))
• SQL injection widespread = 0/10
• MD5 passwords = +1 point
• Some input validation = +1 point
• mysql_escape_string() sometimes used = +1 point
• No extract($_*) disaster = +1 point
• Better than Solar Empire (1/10) but worse than average

Cannot Deploy: Credentials exposed, SQL injection everywhere

---

6.1 Code Quality

Positive Aspects:

• Modular design (17 function modules)
• Comprehensive item system (465 prototypes!)
• 900 GIF graphics (5.6 MB) - Extensive artwork
• Input validation in some places (battle.php)
• mysql_escape_string() used occasionally
• Dynamic module loading (flexible)
• Extensive database schema (40+ tables)
• Turn-based combat replay (battle_movie)
• 4-zone combat system (sophisticated!)

Negative Aspects:

• Frameset UI (obsolete since ~2000)
• Hardcoded credentials (CRITICAL!)
• Dynamic variable injection ($$var)
• Deprecated functions (eregi, session_register, mysql_*)
• Flat file structure (118 PHP files in root!)
• Mixed Russian/English naming
• Magic numbers everywhere
• No framework (raw PHP)
• Windows-1251 encoding (not UTF-8)

6.2 Notable Features

1. Multi-Account System:

• Unique feature allowing alternate characters
• Separate progression per account

2. Building Production:

• Economic simulation with workers
• Hourly resource production
• 6 resource types (diamond, coal, wood, steel, gold, rood)

3. 4-Zone Combat:

• b1, b2, b3, b4 body zone protection
• kick/block zone selection
• Sophisticated damage calculation

4. Injury System:

• Combat restrictions based on injury severity
• Hand-only mode for medium injuries
• Complete combat ban for severe injuries

5. Comprehensive Foraging:

• 25 resource types
• 8 mushrooms, 8 trees, 8 plants
• Time-gated collection

6. Item Modification:

• mod field: -1 broken, -2 unavailable, 1 upgraded, 2 enchanted
• Durability system with repair mechanics

7. Real-Time Combat Logs:

`php

// battle.php lines 78-79

fputs($fp, '
'.date('H:i').' '.$fight_data['action_attacker']);

// Writes HTML battle log to logs/ directory

`

6.3 Database Insights

Massive Item IDs:

`php

// item table: id starts at 2440177

// Suggests millions of items created/destroyed over time

`

Production Server Data:

`php

// SQL dump contains actual player data:

• Battle logs (88252-88263)
• Forest resources for ~130 players
• Clan data (1 clan: "�������������")
• Item prototypes (465 templates)
• Game config (11 variables)

`

Level System:

`php

// expire table: 21 levels

Level 1: 58 exp, 4 money

Level 20: 4,286,914 exp, 16,775 money

Level 21: 2,147,483,647 exp (INT_MAX!)

`

---

7.1 Development Era

Year: ~2007-2008

Evidence:

• SQL dump dated 2007-10-21
• Framesets (obsolete ~2000)
• mysql_* functions (deprecated 2012)
• Russian .ru domain
• windows-1251 encoding

PHP Context: PHP 5.2 era

• session_register() still supported
• eregi() not yet deprecated
• mysql_* standard practice

Web Gaming Context:

• Browser RPGs peak popularity
• Russian MMO scene active
• Framesets still used (but declining)

7.2 Russian Game Development

Cultural Context:

• Russian-language game (windows-1251)
• robotwarz.ru domain
• This email address is being protected from spambots. You need JavaScript enabled to view it. support
• Russian variable naming (sila, lovkost, inta)

Game Style:

• Robot/sci-fi theme (BFG-9000!)
• PvP-focused combat
• Economic simulation
• Social features (gifts, flowers)

7.3 Game Lineage

Influenced By:

• Torn City (stats, combat, items)
• MCCodes (structure, features)
• Russian RPG traditions (detailed stats, equipment)

Similar Games in Collection:

• Other combat RPGs
• Item-heavy systems
• PvP arena games

Unique Features:

• 4-zone combat system
• Multi-account support
• Building production economy

---

8.1 Feature Completeness: 90%

Fully Implemented ( ):

• User registration/login
• PvP arena combat (turn-based with zones!)
• 465 item prototypes (extensive!)
• Equipment system (17 slots)
• Clan system
• Chat system (real-time)
• Forest foraging (25 resources)
• Labirint minigame
• Canalization minigame
• Admin panel
• Multi-account system
• Building production
• Government shop (gosshop)
• Consignment shop (comission)
• Gift/flower system
• Injury mechanics
• Magic scrolls
• Battle replays (battle_movie)
• Moderation tools

Partially Implemented (⚠️):

• FTP integration (ftp_function.php - unclear usage)
• Magic system (mage.php - incomplete?)
• Some admin features

Missing ( ):

• Modern UI (uses framesets!)
• Mobile support
• UTF-8 encoding
• Security fixes

8.2 Playability Assessment

Playable: YES (but INSECURE)

Requirements:

• PHP 5.2-5.6 (mysql_* functions)
• MySQL 4.x-5.x
• windows-1251 charset support
• Browser with frames support

Installation:

• Import ru-robotwarz_2007-10-21_02-32.sql
• Configure inc_config_db.php
• Upload files to web server
• Navigate to game

Production Readiness: 0/10

• Hardcoded credentials exposed
• SQL injection everywhere
• MD5 passwords
• CANNOT DEPLOY PUBLICLY

8.3 Game Balance

Combat System:

• Turn-based fairness
• Zone-based strategy (4 zones)
• Equipment matters (465 items!)
• Injury system adds depth

Economy:

• Government shop (limited stock)
• Player market (comission)
• Building production
• Multiple resource types

Progression:

• 21 levels
• Stat upgrades per level
• Extensive equipment tiers

Social Features:

• Clans
• Gifts/flowers
• Multi-character accounts

---

9.1 Ranking Metrics

Size: Medium

• 118 PHP files
• 23,307 lines
• 900 GIF graphics (unique!)
• Rank: ~40th/79

Security: POOR

• 4/10 rating (hardcoded credentials!)
• Better than Solar Empire (1/10), Skrupel (2/10), Ravan (2/10)
• Worse than average (6/10)
• Rank: ~70th/79

Features: VERY HIGH

• 40+ tables
• 465 item prototypes
• 17 equipment slots
• 25 foraging resources
• 4-zone combat
• Rank: ~10th/79

Graphics: EXCEPTIONAL

• 900 GIF files
• 5.6 MB artwork
• Most graphics-heavy game so far!
• Rank: ~5th/79

Code Quality: Poor

• Framesets
• Hardcoded credentials
• Deprecated functions
• Rank: ~65th/79

9.2 Similar Games Comparison

vs Solar Empire (Game 62 - 1/10):

• Solar Empire: extract($_*) disaster
• Robot Warz: Hardcoded credentials disaster
• Both: SQL injection, MD5 passwords
• Robot Warz: Better (4/10 > 1/10)
• Robot Warz: More features (40+ tables vs 20)
• Winner: Robot Warz (but both terrible)

vs Ravan (Game 56 - 4/10):

• Ravan: eval() vulnerability
• Robot Warz: Hardcoded credentials
• Both: SQL injection, MD5 passwords
• Both: 4/10 security rating (tied!)
• Robot Warz: More graphics (900 GIFs vs none)
• Winner: Tie (different disasters)

vs Solar Imperium (Game 63 - 9/10):

• Solar Imperium: 352 PHP/93K lines, OOP, ADOdb, 9/10
• Robot Warz: 118 PHP/23K lines, procedural, 4/10
• Solar Imperium: Professional code
• Robot Warz: More graphics (900 GIFs)
• Winner: Solar Imperium by landslide

9.3 Unique Position

Strengths:

• Most Graphics-Heavy game analyzed so far (900 GIFs!)
• 4-Zone Combat system (unique mechanics)
• Building Production economy (sophisticated)
• Multi-Account support (rare feature)
• 25 Foraging Resources (extensive variety)

Weaknesses:

• Hardcoded Production Credentials (worst practice!)
• Frameset UI (obsolete technology)
• Deprecated Functions (PHP 5.2 era)

Overall Collection: 40-45th/79

---

10.1 Component Ratings

Aspect	Score	Notes
Security	4/10	Hardcoded credentials, SQL injection, MD5 passwords
Code Quality	3/10	Framesets, deprecated functions, flat structure
Features	9/10	465 items, 4-zone combat, clans, economy, minigames
Completeness	9/10	90% complete, polished systems
Graphics	10/10	900 GIFs (5.6 MB artwork) - EXCEPTIONAL
Innovation	7/10	4-zone combat, multi-account, building production
Balance	7/10	Turn-based fairness, extensive equipment tiers
Playability	7/10	Works on PHP 5.2, complete game loop
Maintainability	2/10	Deprecated functions, hardcoded credentials

10.2 Overall Rating: 6/10

"Graphics-Rich Russian Combat RPG with Hardcoded Credentials Disaster"

10.3 Strengths

900 GIF Graphics - Most artwork-heavy game analyzed!

465 Item Prototypes - Extensive equipment variety

4-Zone Combat - Unique strategic depth

Building Production - Economic simulation

25 Foraging Resources - Comprehensive gathering

Multi-Account System - Alternate character support

Clan Features - Guilds with shared weapons

Modular Architecture - 17 function modules

Turn-Based Combat Replay - Battle movie system

Injury Mechanics - Combat restrictions add depth

Real-Time Chat - Delayed inserts for performance

10.4 Critical Weaknesses

HARDCODED PRODUCTION CREDENTIALS - Database/FTP passwords exposed!

SQL INJECTION EVERYWHERE - Direct $_GET/$_POST in queries

MD5 PASSWORDS - No salt, rainbow table vulnerable

FRAMESET UI - Obsolete since ~2000

DYNAMIC VARIABLE INJECTION - $$var creates globals from DB

DEPRECATED FUNCTIONS - eregi, session_register, mysql_*

FLAT FILE STRUCTURE - 118 PHP files in root

WINDOWS-1251 ENCODING - Not UTF-8

NO CSRF PROTECTION - Forms lack tokens

SESSION FIXATION - No regeneration on login

10.5 Verdict

Robot Warz is a feature-rich Russian robot combat RPG with exceptional graphics (900 GIFs!), sophisticated gameplay systems (4-zone combat, building production, multi-accounts), and comprehensive content (465 items, 25 resources). However, it contains one of the WORST security practices possible: hardcoded production database and FTP credentials directly in the source code. Combined with widespread SQL injection, MD5 passwords, and an obsolete frameset UI, this game is completely undeployable in any modern environment.

The hardcoded credentials in inc_config_db.php expose the entire production database (host='80.93.49.170', user='ru-robotwarz', pass='f8157afbec'). This is Security 101 violation - credentials must NEVER be in source code. Additionally, SQL injection is everywhere due to custom escaping functions that use HTML entity encoding instead of proper SQL escaping.

Beyond the catastrophic security issues, the game uses obsolete technologies: framesets (abandoned ~2000), deprecated PHP functions (eregi, session_register, mysql_), and windows-1251 encoding. The code requires PHP 5.2-5.6 and is incompatible with PHP 7.0+ due to removed mysql_ functions.

As a piece of gaming history, Robot Warz demonstrates the Russian browser RPG scene of 2007-2008, with extensive artwork (5.6 MB graphics!), sophisticated combat mechanics (4-zone system), and unique features (multi-account support, building production economy). The 465 item prototypes and 25 foraging resources show impressive content depth.

The game would require 100-200 hours of complete rewrite to be remotely safe: remove all credentials, convert to PDO, replace MD5 with bcrypt, modernize the UI (remove framesets), upgrade to PHP 8.x, implement UTF-8, add input validation, implement CSRF protection, and restructure the file organization. Until then, it's a hacking playground.

10.6 Recommended For

• Game Designers: Study 4-zone combat system, multi-account design
• Graphics Researchers: Examine 900 GIF artwork collection
• Security Students: Learn what NOT to do (credential exposure)
• History Buffs: Russian browser RPG scene (2007-2008)

10.7 Not Recommended For

• Public Deployment: Hardcoded credentials = instant compromise
• Production Use: SQL injection everywhere
• Learning PHP: Teaches deprecated/dangerous practices
• Modern Hosting: PHP 7.0+ incompatible
• Mobile Players: Frameset UI unusable on mobile

10.8 Historical Significance

High - Represents peak of Russian browser RPG development (2007-2008), demonstrates graphics-heavy approach (900 GIFs), showcases sophisticated combat mechanics (4-zone system), preserves multi-account gameplay innovation, documents frameset UI era, contains production database dump (historical snapshot), serves as cautionary tale about credential management, and provides reference for building production economies in browser games.

---