Vallheru is a professional-grade fantasy MMORPG engine—rich with crafting chains, multi-market economies, guilds with ranks and permissions, housing, quests, courts, and a creature “core” arena. It’s a social sandbox where players gather resources, forge gear, trade across specialized markets, and build communities through forums, newspapers, libraries, and chat.
Under the hood, Smarty templates and ADOdb abstraction power a clean, modular architecture with multi-language support. It’s the rare 2010-era browser RPG that’s both feature-complete and engineered for maintainability, making it a standout candidate for modern revival.
Name: Vallheru (Tallos Engine 0.1.3)
Developer: Tallos Team (based on Vallheru by Gamers-Fusion 2.5)
Original: Gamers-Fusion (2004-2006)
Fork Date: 2010
Genre: Fantasy MMORPG with extensive crafting, economy, and social systems
Type: Text-based browser MMORPG with sophisticated architecture
License: GNU GPL v2
---
Total Files: 1,093
Total Size: 8,278 KB (~8.1 MB)
Total PHP Lines: 127,307 (LARGEST in collection!)
File Breakdown:
Database Schema: 1,637 lines, 89 tables (MOST COMPLEX in collection!)
Key Statistics:
Technologies:
---
Vallheru represents the most professional architecture in the entire collection:
Model-View-Controller-like Structure:
`
vallheru/
├── class/ # Model layer (Player.Class.php)
├── templates/ # View layer (104 .tpl files)
├── *.php # Controller layer (568 files)
├── libs/ # Smarty templating engine
├── adodb/ # Database abstraction layer
├── includes/ # Core functions and config
├── languages/ # Localization files (pl, en, de, etc.)
├── javascript/ # Client-side scripts
├── css/ # Stylesheets (40 files!)
├── images/ # Graphics assets
├── mailer/ # PHPMailer library
└── install/ # Installation wizard
`
Key Architectural Features:
`php
$smarty = new Smarty;
$smarty -> assign(array("Gamename" => $gamename,
"Player" => $player));
$smarty -> display('template.tpl');
`
`php
$db -> Execute("SELECT * FROM players WHERE id=?", array($id));
$result -> RecordCount();
$result -> fields['column'];
`
`php
class Player {
public function LogIn($email, $password)
public function CheckBan($id, $user, $email)
private $AllowableHTML // XSS protection
}
`
`php
require_once("languages/".$player -> lang."/index.php");
// Auto-detects browser language
// Falls back to Polish (default)
`
`php
// Uses ADOdb session handler
// Server-side session storage in database
$_SESSION['email'] = $strEmail;
$_SESSION['pass'] = md5($password);
`
---
Core Tables:
players - 89 fields! (still excessive but normalized vs VA-RPG)aktywacja - Account activationsessions - ADOdb session storagesettings - Game configurationEconomy & Trading:
amarket - Armor marketpmarket - Potion markethmarket - Herb marketimarket - Item marketmmarket - Mineral marketrmarket - Resource marketcore_market - Core (pet/creature) marketCrafting & Production:
alchemy_mill - Alchemy workshopsmill - Grain millssmelter - Ore smeltingsmith - Blacksmithingjeweller - Jewelry craftingfarm - Farming systemmines - Mining operationslumberjack - Woodcuttingwarehouse - Storage facilitiesEquipment & Items:
equipment - Player equipment (weapons, armor, shields, helmets, etc.)bows - Ranged weaponsrings - Jewelrypotions - Consumablesherbs - Alchemy ingredientsminerals - Crafting materialsmage_items - Magical itemsCombat & Characters:
core - Core arena (creature battles)cores - Core definitionsmonsters - Enemy creaturesczary - Spells/magic systemSocial & Community:
tribes - Guilds/clans (extensive system)tribe_rank - Guild hierarchytribe_perm - Guild permissionstribe_mag - Guild warehousetribe_zbroj - Guild armorytribe_topics - Guild forumstribe_replies - Guild forum postsmessages - Private messagingchat - Chat systemchat_config - Chat settingsLocation & World:
houses - Player housingoutposts - Wilderness outpostsoutpost_monsters - Outpost encountersoutpost_veterans - NPC defendersportals - Fast travel systembridge - Bridge riddle gameLegal & Administrative:
court - Player court systemcourt_cases - Legal casesjail - Player imprisonmentban - Account bansban_mail - Email bansreset - Account resetsbugreport - Bug trackingContent & Communication:
news - Game announcementsnews_comments - News discussionnewspaper - Player-created newspapernewspaper_comments - Newspaper discussionlibrary - Player-written bookslib_comments - Book reviewsforums - Public forumstopics - Forum topicsreplies - Forum postscategories - Forum categoriespolls - Voting systempolls_comments - Poll discussionMeta & Tracking:
logs - Player action logslog - Player notificationsevents - Game eventschangelog - Development historyupdates - Update announcementsupd_comments - Update discussionshalloffame - Leaderboardsdonators - Supporters listlinks - Player linksbad_words - Profanity filterlost_pass - Password recoveryadodb_logsql - SQL query loggingQuests & Tasks:
quests - Quest definitionsquestaction - Quest progress trackingReligion & Deity:
deity - God/pantheon systemtemple - Religious worshipAstral Plane (Special Dimension):
astral - Astral realm itemsastral_bank - Astral storageastral_machine - Astral craftingastral_plans - Astral blueprints---
Races (Rasa):
Classes (Klasa):
Primary Attributes:
Secondary Stats:
PvE Combat:
PvP Combat:
Core Arena:
Unique creature battle system:
`php
// Players collect and breed creatures called "Cores"
// Cores have power, defense, wins, losses
// Arena matches pit cores against each other
// Training and evolution system
`
Core Features:
Production Chains:
Alchemy:
Blacksmithing:
Jewelry:
Farming:
Woodcutting:
Mining:
House System:
House Features:
Extensive Guild Features:
Guild Permissions:
Private Messaging:
`php
// Folders: Inbox, Sent, Saved
// Read/unread tracking
// Subject and body
// Date/time stamps
`
Chat System:
Forums:
Newspaper:
Library:
Court:
Jail:
Crimes Tracked:
Locations:
Travel System:
Bridge Riddle:
Spell System (Czary):
Deity System:
Blessings:
Referral System:
Polls:
Hall of Fame:
Monuments:
Quest System:
Training:
Rest System:
Notebook (Notatnik):
Staff Roles:
Admin Capabilities:
Moderation:
---
1. ADOdb Prepared Statements:
`php
$db -> Execute("SELECT * FROM players WHERE id=?", array($id));
// Parameterized queries prevent SQL injection
`
2. Session-Based Authentication:
`php
// Server-side session storage
// No plain-text cookies
$_SESSION['email'] = $strEmail;
$_SESSION['pass'] = md5($password); // Still MD5 but session-protected
`
3. XSS Protection:
`php
class Player {
private $AllowableHTML = array('br' => array(), 'strong' => array(), ...);
// Whitelist approach to HTML filtering
}
htmlspecialchars() // Used throughout
`
4. Email Validation:
`php
require_once('includes/verifymail.php');
if (MailVal($_POST['email'], 2)) {
// Reject invalid emails
}
`
5. Password Verification:
`php
require_once('includes/verifypass.php');
verifypass($_POST['pass'],'register');
// Enforces password complexity
`
6. IP Tracking:
`php
// IP logging for registration
// Ban by IP
// Multi-accounting detection
`
7. Account Freeze:
`php
if ($LogIn -> fields['freeze'] > 0) {
message(sprintf($lang['ACCOUNT_FREEZE'], $LogIn -> fields['freeze']), 'error');
}
// Temporary suspension system
`
8. Ban System:
`php
$this -> CheckBan($id, $user, $email);
// Multi-level banning (account, IP, email)
`
1. MD5 Password Hashing (CRITICAL):
`php
$strPass = md5($password);
// No salt, deprecated algorithm
// Should use password_hash() with bcrypt
`
2. Session Password Storage:
`php
$_SESSION['pass'] = md5($password);
// Stores hashed password in session
// Unnecessary - session ID sufficient
`
3. Deprecated ereg Functions:
`php
if (ereg(".htm*$", $file)) // PHP 5.3+ deprecated
if (eregi($strSearch, $strLanguage)) // PHP 5.3+ deprecated
// Should use preg_match()
`
4. MySQL-Specific Code:
`php
// Despite ADOdb, some MySQL-specific queries exist
// Reduces true portability
`
5. No CSRF Protection:
`php
// Forms lack CSRF tokens
// Vulnerable to cross-site request forgery
`
6. Magic Quotes Checking:
`php
$strUser = $db -> qstr($_POST['user'], get_magic_quotes_gpc());
// Relies on deprecated magic_quotes
`
---
"Tallos Engine" fork represents professionalization:
For 2010, Vallheru/Tallos was cutting-edge:
---
FULLY IMPLEMENTED:
Character creation (race, class, attributes)
Combat system (PvE, PvP)
Core arena (creature battles)
Crafting (alchemy, smithing, jewellery)
Resource gathering (mining, lumberjack, herbalist)
Production buildings (mills, smelters, workshops)
Economy (7 separate markets!)
Guild system (tribes) with full management
Housing system
Messaging system
Chat system
Forum system (public & guild)
Newspaper system
Library system
Court/jail system
Deity/religion system
Quest system
Training system
Travel/exploration
Portal network
Bridge riddle
Maze/Grid dungeon
Tower challenge
Outpost system
Astral plane dimension
Polls system
Hall of Fame
Referral system
Administrative tools
Ban system
Bug reporting
Changelog tracking
Multi-language support
RSS feeds
Email integration
Session management
Installation wizard
MINOR ISSUES:
⚠️ Some translations incomplete (English has gaps)
⚠️ Flash-based chat may not work (SWF file present)
⚠️ Some features Polish-language only documentation
NOT IMPLEMENTED:
Mobile-responsive design (2010 predates mobile focus)
Modern password hashing (MD5 legacy issue)
Strengths:
Minor Issues:
What Works:
What Might Break:
Performance:
---
LARGEST:
MOST PROFESSIONAL:
MOST COMPLEX:
MOST SOCIAL:
| Game | PHP Lines | Files | Architecture | Templates | DB Tables |
|---|---|---|---|---|---|
| VA-RPG | 8,903 | 44 | Monolithic (7,277-line file) | None | 14 |
| Ugamela TT | 30,588 | 565 | MVC with Smarty | 162 | ~30 |
| Travian | 30,713 | 1,557 | Modular OOP | Mixed | ~40 |
| Vallheru | 127,307 | 568 | Professional MVC | 104 | 89 |
| Feature | VA-RPG | Ugamela | Travian | Vallheru |
|---|---|---|---|---|
| Combat | Basic | Broken | MMORTS | Advanced |
| Crafting | ⚠️ Simple | None | ⚠️ Simple | Extensive |
| Guilds | ⚠️ Basic | Alliances | Alliances | Full Management |
| Economy | ⚠️ Single Market | Trading | Resources | 7 Markets |
| Social | ⚠️ Mailbox | Messages | Messages | Everything! |
| Content | None | None | None | Newspaper/Library |
---
Breakdown:
Vallheru/Tallos represents the pinnacle of PHP browser RPG development circa 2010:
What It Did Right:
Legacy:
Required Work:
Estimated Effort: 40-60 hours
Why It's Viable:
For Learning: ★★★★★
This is THE game to study for:
For Revival: ★★★★★
Best candidate in entire collection:
For Playing: ★★★★★
Most engaging game in collection:
---
Database Size: 1,637 lines SQL (89 tables)
Estimated Storage: 8.3 MB code + database
PHP Version Required: 5.2-7.4 (needs minor updates for 8.x)
MySQL Version: 5.0+ (ADOdb supports others)
Browser Requirements: JavaScript, cookies, modern browser
Performance: Excellent (caching, optimized queries)
Scalability: Very good (session storage, database abstraction)
Dependencies:
Deployment Difficulty: 6/10 (installation wizard helps)
Maintenance Difficulty: 3/10 (clean code, well-organized)
Extension Difficulty: 4/10 (modular, plugin-friendly)
---
Original Sites:
Documentation:
Active Development:
---
Vallheru (Tallos Engine) is not just the largest game in the collection - it's the most professional, most complete, and most educational.
Why It Stands Out:
If You Remember One Thing:
Vallheru is what a professional PHP browser RPG looks like. It's the game all the others should have been.
Comparison to VA-RPG (Game 68):
Who Should Study This:
Revival Potential:
With 40-60 hours of security updates (mainly password hashing), Vallheru could run on modern servers and attract players TODAY. The gameplay is timeless, the code is clean, and the features are comprehensive.
---
Analysis Date: December 11, 2024
Game #69 of 79 in the Vintage Browser RPG Collection
Status: Fully functional, professionally architected, best in collection
Verdict: The game that deserves to be revived
Running many of the scripts in this archive on a live server presents a serious security risk. These projects were created before modern hardening practices and may contain vulnerabilities that can compromise your system.
We strongly recommend using this code for reference and analysis only, or in isolated local environments. By downloading these files, you accept full responsibility for their use.