Voided Alliance

Monolithic Single-File Design

Voided Alliance uses an extreme single-file architecture:

`

voided_alliance/

├── index.php # 7,321 LINES (78% of codebase!)

├── connect.php # Database + sanitization

├── register.php # Registration

├── login.php # Authentication

├── installer.php # Setup wizard

├── includes/

│ ├── header.php # Page header

│ ├── footer.php # Page footer

│ ├── leftmenu.php # Left navigation

│ ├── rightmenu.php # Right navigation

│ ├── functions.php # Utilities

│ ├── util.php # More utilities

│ └── version.php # Version info

├── addbook.php # Add books

├── addchar.php # Add characters

├── additem.php # Add items

├── addnews.php # Add news

├── changepass.php # Password change

├── donatecredits.php # Donate credits

├── edititem.php # Edit items

├── editstats.php # Edit stats

├── galaxyCP.php # Galaxy control panel

├── joinguild.php # Join guild

├── sellitem.php # Sell items

├── sendmail.php # Send messages

└── spellinfo.php # Spell information

`

Database Connection (connect.php) - GOOD SECURITY:

`php

parse_str("$QUERY_STRING");

include_once('config.php')

$db = mysql_connect("$dbhost", "$dbuser ", "$dbpasswd");

// PROPER INPUT SANITIZATION!

if(!get_magic_quotes_gpc()) {

$_GET = array_map('mysql_real_escape_string', $_GET);

$_POST = array_map('mysql_real_escape_string', $_POST);

$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);

} else {

$_GET = array_map('stripslashes', $_GET);

$_POST = array_map('stripslashes', $_POST);

$_COOKIE = array_map('stripslashes', $_COOKIE);

$_GET = array_map('mysql_real_escape_string', $_GET);

$_POST = array_map('mysql_real_escape_string', $_POST);

$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);

}

?>

`

Authentication (login.php):

`php

if (strtolower(mysql_result($ec,$i,"user"))==strtolower($_POST['user'])

and mysql_result($ec,$i,"password")==md5($_POST['pass'])) {

// Login successful - MD5 hashing used!

}

`

Session Management:

`php

// Cookie-based sessions

$userSession = $_COOKIE['va_users'];

// Session validation

$query2 = "SELECT * FROM va_session";

for ($i = 0; $i < $num2; $i++) {

if (mysql_result($result2,$i,"session") == $_COOKIE['va_users']) {

$timeLeft = mysql_result($result2,$i,"time");

$usr_N_R = mysql_result($result2,$i,"user");

$foundSes = true;

}

}

if ($foundSes != true) {

setcookie("va_users",FALSE);

header("Location: index.php?page=index");

die();

}

`

The 7,321-Line index.php:

• Contains ENTIRE game logic
• Routing via $_GET['page']
• Switch statements for pages
• Nested switch for game pages
• All features in one file
• No code organization
• Impossible to maintain

---

21 Tables - Mixed Space/Fantasy Theme:

Core System:

• va_config - Game configuration
• Game name, last reset, description
• va_session - Session management
• Session ID, user, time
• va_users - Player accounts (MASSIVE!)
• 30 inventory slots (inv0-inv29)
• 30 spell slots (spell0-spell29)
• Equipment (weapon, shield, helmet, armor, gloves, boots)
• Stats (HP, MP, str, def, AC, luck)
• Level, XP, currency, points
• Access level (admin system)
• Galaxy position
• Class selection
• PvP stats (wins/losses)
• Guild membership
• Shop ownership

Galaxy System (Space Theme!):

• va_galaxy - Solar systems/galaxies
• Name (Pegasus, Kironus, Nairah, etc.)
• Owner ID
• Government type
• Toll entrance/exit fees
• Registration costs
• 12 galaxies pre-configured

Items & Crafting:

• va_items - Item database (HUGE!)
• Name, description, image
• Type (weapon, armor, consumable, etc.)
• Stats (str, def, HP, MP bonuses)
• Sell price
• Crafting complexity
• 80+ items in sample data
• va_recipe - Crafting recipes
• Item combinations
• Workstation requirements
• va_worktable - Player crafting queue
• va_bank - Item banking

Shopping System:

• va_shops - Player-owned shops
• Owner, location, inventory
• va_NPCshop - NPC vendor shops
• Name, script, image
• va_NPCstock - NPC inventory
• Item ID, shop ID, price
• Respawn timers

Social Features:

• va_guilds - Player guilds/clans
• Name, owner, description
• Guild image
• Password protection
• Custom guild page
• va_chat - Global chat
• va_mailbox - INSANE DESIGN!
• 30 sender fields (mbS0-mbS29)
• 30 message fields (mbM0-mbM29)
• 30 title fields (mbT0-mbT29)
• 30 from fields (mbF0-mbF29)
• 120 TEXT COLUMNS FOR 30 MESSAGES!

Content:

• va_books - In-game books/library
• Name, author, description, text
• Level requirement
• 16 books with extensive lore
• va_news - News/announcements

Combat & Competition:

• va_buffs - Temporary stat buffs
• Duration, stat bonuses
• va_bounty - Bounty/hitlist system
• va_classes - Character classes
• Human, Allicarin, Human Dark Paladin, Alien

Admin Tools:

• va_bans - Ban system
• Player ID, ban length
• va_ticket - Support tickets

---

1. Galaxy System (Space Theme)

Multiple Galaxies:

• 12 unique galaxies to explore
• Each galaxy has:
• Owner (can be player!)
• Government type
• Entry toll
• Exit toll
• Registration fee
• Examples:
• Pegasus - 1000 entry, free exit
• The Milky Way - 50 entry, 2500 exit
• Kironus - 100 entry, free exit

Galaxy Control:

• Players can own galaxies
• Set tolls and fees
• Government types (0-9999)
• Collect revenue from travelers

2. Character System

Classes:

• Human - Standard race
• Allicarin - Super intelligent race
• Human Dark Paladin - Mutated human
• Alien - Small green creature

Stats:

• HP/MP - Health and magic points
• Strength - Attack power
• Defense - Damage reduction
• Armor Class (AC) - Dodge chance
• Luck - Critical hits/drops
• Level - Character progression
• XP - Experience points

Equipment Slots:

• Weapon
• Shield
• Helmet
• Armor
• Gloves
• Boots

30 Spell Slots:

• Custom spell names
• Text-based spell system
• Learn from books

3. Crafting System

Workstations:

• Oven - Baking/cooking
• Chemistry Lab - Potion brewing
• Forging - Weapons/armor
• Mixing/Stirring - Ingredients

Complexity Levels:

• Complexity 2 - Simple recipes
• Complexity 3 - Intermediate
• Complexity 4 - Advanced
• Higher complexity = better results

Example Recipes (from books):

Fiery Chocolate Goo:

• Combine Fiery Ember + Chocolate Goo
• Use: Oven
• Complexity: 2

Chocolate Potion:

• Chocolate Cake + Hot Chocolate = Chocolate Goo
• Chocolate Goo + Healing Potion = Chocolate Potion
• Use: Chemistry Lab
• Complexity: 4

Chocolate Cupcake:

• Dough + Fiery Chocolate Goo
• Use: Oven
• Complexity: 3

Thermal Shield:

• 2 Iron Bars + 2 Plain Magical Dusts
• Use: Forging
• Complexity: Unknown

4. Economy System

Currency:

• Credits (main currency)
• Points (special currency)

Banking:

• Bank items securely
• Withdraw anytime
• Item storage

Player Shops:

• Create your own shop
• Set prices
• Manage inventory
• Located in galaxies

NPC Shops:

• Fixed vendors
• Item respawn timers
• Set prices

Trading:

• Donate credits to players
• Item trading
• Sell items

5. Social Features

Guilds:

• Create guilds with passwords
• Guild page (custom HTML?)
• Guild description
• Guild images
• Member management

Mail System:

• 30 message slots per player
• Read/Unread tracking
• Sender, title, message, from fields
• Unread mail notifications

Chat:

• Global chat system
• Real-time communication

Books/Lore:

16 in-game books including:

• "Poor o' Plenty" - Blank pages mystery
• "The Tome of the Undead" - Sealed magic book
• "Legend of the Bronze Plasma" - Alchemist story
• "The Simple Elements" - Fire/Ice/Shock magic guide
• "The Advanced Elements" - Undead/Holy/Nature/Trinity magic
• "Cook Book" - Fiery Chocolate Goo recipes
• "The World in There Hands" - 15-page epic sci-fi story!
• "Hanz's Kitchen Book 1" - Chocolate Glazed Doughnuts
• "Guide To Making Great Armor" - Forging basics
• "Armor Crafting for Cavemen" - Easy armor recipes
• "Expertise Cook Book" - Radioactive Potato recipe
• "Erisior's beginning" - Fantasy character backstory
• "English, a hard language to learn" - Jack & Jill riddle

6. Combat System

PvP:

• Player vs Player battles
• PvP score tracking
• PK (player kills) counter

Buffs:

• Temporary stat boosts
• Battle duration
• Str/Def/AC/etc bonuses

Bounties:

• Place bounties on enemies
• Collect rewards for kills

7. Admin Features

Access Levels:

• Level 1 - Normal player
• Level 5 - Admin (from installer)
• Custom levels possible

Admin Tools:

• Add books (addbook.php)
• Add items (additem.php)
• Add news (addnews.php)
• Edit items (edititem.php)
• Edit stats (editstats.php)
• Galaxy control panel (galaxyCP.php)
• Ban players

Support System:

• Ticket submission
• Admin responses
• Category selection

8. Quality of Life

Refresh System:

• Auto-refresh tracking
• lastref timestamp
• 15-minute intervals

Default Password Warning:

`php

$badpass = md5("abcd");

if ($badpass == $pass) {

echo "It is highly recommended that you change your password";

}

`

Mail Notifications:

• Unread mail alerts
• Red text warnings
• Link to inbox

Installer:

• Web-based installation
• Auto-create admin account
• Configure database
• Initialize tables

---

Good Security Practices:

1. MD5 PASSWORD HASHING ✓

`php

$query = "INSERT INTO va_users VALUES ('','" . $_POST['user'] . "','"

. md5($_POST['pass']) . "','" . $_POST['email'] . "'...)";

if (mysql_result($ec,$i,"password")==md5($_POST['pass'])) {

// Login successful

}

`

2. INPUT SANITIZATION ✓

`php

// Comprehensive sanitization in connect.php

$_GET = array_map('mysql_real_escape_string', $_GET);

$_POST = array_map('mysql_real_escape_string', $_POST);

$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);

`

• Handles magic quotes
• Applies to all inputs
• SQL injection protection

3. SESSION VALIDATION ✓

`php

// Validates session exists

if ($foundSes != true) {

setcookie("va_users",FALSE);

header("Location: index.php?page=index");

die();

}

`

4. SEPARATE CONFIG FILE ✓

`php

include_once('config.php')

// Database credentials in separate file

`

Security Issues:

1. MD5 IS DEPRECATED (MEDIUM)

• MD5 crackable with rainbow tables
• Should use bcrypt/password_hash()
• Better than plain-text though!

2. COOKIE-BASED SESSIONS (MEDIUM)

`php

$userSession = $_COOKIE['va_users'];

`

• No PHP sessions ($_SESSION)
• Cookies can be forged
• No httponly/secure flags
• Session fixation possible

3. SHORT PHP TAGS (LOW)

`php

`

• Requires short_open_tag = On
• Breaks on modern PHP

4. DEPRECATED MYSQL FUNCTIONS (MEDIUM)

`php

mysql_connect()

mysql_query()

mysql_result()

mysql_numrows()

`

• Removed in PHP 7.0
• Should use mysqli/PDO

5. NO CSRF PROTECTION (MEDIUM)

• No tokens on forms
• Cross-site request forgery possible

6. PARSE_STR VULNERABILITY (HIGH)

`php

parse_str("$QUERY_STRING");

`

• Dangerous! Creates variables from query string
• Can overwrite existing variables
• Variable injection attack vector
• Should NEVER use parse_str without 2nd parameter

7. EXTRACT() LIKELY USED (HIGH)

• Common in this era
• Variable injection risk
• Haven't seen it yet but probable

8. NO XSS PROTECTION (MEDIUM)

• No htmlspecialchars() on output
• User input displayed raw
• Stored XSS in profiles/messages

Overall Security Rating: 5/10

• Good: MD5 hashing, input sanitization, session validation
• Bad: parse_str() vulnerability, cookie sessions, deprecated functions
• Better than: Vice Warz (2/10), VA-RPG (4/10)
• Worse than: Vallheru (9/10), Travian (8/10)

---

2006: Auburnflame Games Era

Voided Alliance represents amateur game studio development:

Developer: Raygoe (Auburnflame Games)

• Forum: forum.auburnflame.com
• Website: auburnflame.com
• Solo/small team operation
• Custom GPL license
• "Revolution" engine/version

Release Timeline:

• Started: 2006
• Last Reset: September 21, 2006
• Active through: 2008
• Version tracked in version.php

Interesting Details:

• 174 PNG images - Most visual game yet!
• Extensive item artwork
• Custom class images
• Professional-looking graphics
• Books with 15-page stories
• Deep crafting system
• Galaxy ownership mechanics

The Custom License

Auburnflame GPU (General Public License):

• Must keep copyright notices
• Must keep link to Auburnflame
• Cannot remove attribution
• Can edit but not rebrand
• "Any changes... are valid"
• Auburnflame can change license anytime
• No warranty

Unusual Clauses:

• "Action will be taken" for violations
• Authoritarian license control
• Not actually GPL-compatible
• More restrictive than GPL

The Lore

"The World in There Hands" (Book #9):

• 15-page sci-fi epic!
• Year 3113
• Meteor crash in Greenland
• Robot invasion
• AI enslavement of humanity
• 2,500 human survivors
• Brothers Sander and Seth
• Battle tank discovery
• Journey to impact crater
• Longest in-game book in collection!

This shows significant world-building effort - rare in browser RPGs.

---

Feature Completeness: 80%

FULLY IMPLEMENTED:

Registration system

Login with MD5 hashing

Session management

Character creation (4 classes)

Galaxy system (12 galaxies)

Inventory system (30 slots)

Equipment system (6 slots)

Spell system (30 slots)

Stat system (HP, MP, str, def, AC, luck)

Level/XP progression

Item database (80+ items)

Crafting system with recipes

Workstation types (oven, forge, lab)

Player shops

NPC shops with respawn

Banking system

Guild system

Mail system (30 messages)

Chat system

Book library (16 books!)

News system

Bounty system

Buff system

PvP tracking

Galaxy ownership

Toll/fee system

Admin tools

Ban system

Support tickets

Web installer

UNCLEAR:

⚠️ Combat calculations

⚠️ Spell effects

⚠️ Item drop system

⚠️ Monster battles

MISSING/INCOMPLETE:

Combat interface (no battle.php seen)

Monster/NPC enemies

Quest system

Achievement system

Playability: 70%

What Works:

• Create account
• Choose class
• Travel galaxies (with tolls!)
• Craft items via recipes
• Buy/sell in shops
• Join guilds
• Send mail
• Read 16 books
• Admin tools functional

What's Unclear:

• How to fight monsters
• How to gain XP/level up
• How spells work
• Combat mechanics

Code Quality Issues:

• 7,321-line index.php (78% of code!)
• No code organization
• Impossible to debug
• No MVC structure
• Everything in one file

---

Code Organization:

Game	Lines	Main File	Organization	Rating
Vallheru	127,307	Distributed	MVC + Smarty	10/10
Vice Warz	7,577	Various	Procedural	5/10
Voided Alliance	9,432	7,321-line index.php	Monolithic	2/10
VA-RPG	8,903	7,277-line index.php	Monolithic	1/10

Voided Alliance vs VA-RPG:

Both use massive single-file designs, but:

• Voided Alliance: 7,321 lines (78%)
• VA-RPG: 7,277 lines (82%)
• Nearly identical architectures!
• Both impossible to maintain
• Voided Alliance has better security

Unique Features:

Only Game With:

• Galaxy ownership system
• Toll/fee collection
• 30 inventory slots
• 30 spell slots
• 120-column mailbox (mbS0-mbF29)
• 15-page in-game novel
• Radioactive Potato recipe
• Chocolate crafting specialization
• 174 PNG images (most visual!)

Image Richness:

• 174 PNG + 28 GIF + 1 JPG = 203 images
• Most visual game in collection
• Vallheru had ~100 images
• Professional artwork quality

---

Rating: 5/10

Breakdown:

• Security: 5/10 (MD5 + sanitization, but parse_str issue)
• Code Quality: 2/10 (7,321-line monolith)
• Features: 8/10 (galaxy system, crafting, 30 slots)
• Completeness: 8/10 (most features implemented)
• Innovation: 7/10 (galaxy ownership unique)
• Visuals: 9/10 (203 images - best in collection!)

Strengths:

• Best visuals in collection - 203 images!
• MD5 password hashing - Better than plain-text
• Input sanitization - mysql_real_escape_string on all inputs
• Galaxy system - Unique ownership/toll mechanics
• 30 inventory slots - Largest inventory yet
• 30 spell slots - Extensive magic system
• Crafting system - Recipes with workstations
• 16 in-game books - Including 15-page novel!
• Item variety - 80+ items
• Web installer - Easy setup
• Default password warning - Security awareness
• Session validation - Proper session checking

Weaknesses:

• 7,321-LINE index.php FILE 🔥 (78% of codebase!)
• parse_str() vulnerability - Variable injection
• Monolithic design - Unmaintainable
• Cookie-only sessions - No PHP $_SESSION
• MD5 hashing - Deprecated (use bcrypt)
• Deprecated mysql_* functions - PHP 7 incompatible
• Short PHP tags - Modern PHP breaks
• No CSRF protection - Form vulnerability
• No XSS protection - htmlspecialchars missing
• 120-column mailbox table - Database design nightmare
• No combat interface seen - Unclear how to fight
• No code organization - Everything in one file

Historical Significance:

The Visual Leader:

• 203 images (174 PNG!)
• Professional artwork
• Custom class graphics
• Item illustrations
• Most polished visuals in collection

The World Builder:

• 15-page sci-fi novel in-game
• 16 books with lore
• Galaxy naming (Pegasus, Kironus, etc.)
• Crafting recipe variety
• Significant effort on content

The Monolith:

• 7,321-line index.php
• Ties VA-RPG for worst code organization
• Shows copy/paste culture
• "Just add more to index.php!"
• Maintenance nightmare

Modern Revival Feasibility: 3/10 (Possible But Painful)

Challenges:

• Refactor 7,321-line index.php - Break into modules
• Upgrade to mysqli/PDO - Replace all mysql_*
• Remove parse_str() - Security critical
• Implement proper sessions - Replace cookies
• Add bcrypt - Replace MD5
• Normalize mailbox table - 120 columns insane
• Add CSRF tokens - Protect forms
• Add XSS protection - Escape all output

Revival Strategy:

• Extract logic from index.php into separate files
• Create proper routing system
• Upgrade database layer
• Implement modern auth
• Add security features
• Modernize HTML/CSS
• Estimated effort: 80-100 hours

Worth It?

• YES if you value the galaxy system
• YES if you want extensive visuals
• YES if you like crafting mechanics
• NO if starting fresh is easier
• The feature set is good, code is the problem

---

The Beautiful Disaster

Voided Alliance is a paradox:

The Good:

• Best visuals in entire collection (203 images!)
• Unique galaxy ownership mechanics
• 16 in-game books with 15-page novel
• Extensive crafting system
• 30 inventory + 30 spell slots
• Better security than most (MD5 + sanitization)

The Bad:

• 7,321-line index.php (worst code organization)
• parse_str() vulnerability
• Monolithic design
• Deprecated functions
• Cookie-only sessions

The Pattern:

Like VA-RPG (#68), this game shows:

• Amateur developer
• "Add everything to index.php" mentality
• Feature-rich but code-poor
• Visuals over architecture
• Security awareness (MD5) but incomplete

Developer Ambition

Raygoe (Auburnflame Games) clearly had big plans:

Evidence:

• 203 professionally-designed images
• 16 books with extensive lore
• 15-page sci-fi epic
• 12 named galaxies
• Complex crafting recipes
• Galaxy ownership economics
• Toll/fee systems

But...

• Put 78% of code in one file
• No separation of concerns
• Impossible to maintain
• Never properly organized

Lesson:

"Great ideas need great structure. Without architecture, features become chaos."

Comparison to VA-RPG

Both games share identical architectural failure:

Metric	Voided Alliance	VA-RPG
Main file lines	7,321	7,277
% of codebase	78%	82%
Security	5/10 (MD5 + sanitize)	4/10 (MD5, weak sanitize)
Innovation	Galaxy system	Letter spell crafting
Visuals	203 images (9/10)	Minimal (3/10)
Final Rating	5/10	4/10

Verdict: Voided Alliance is VA-RPG with better visuals and security, but same terrible architecture.

---

Database Size: 747 lines SQL (21 tables)

PHP Version Required: 5.2-5.6 (short_open_tag, mysql_* functions)

MySQL Version: 4.0-5.7 (MyISAM tables)

Browser Requirements: Cookies, JavaScript

Installation: Web-based installer (installer.php)

Deployment Difficulty: 3/10 (installer makes it easy)

Maintenance Difficulty: 9/10 (7,321-line file nightmare)

Revival Difficulty: 7/10 (major refactoring needed)

Notable:

• Largest single file in collection (7,321 lines!)
• Most images in collection (203 total!)
• Longest in-game book (15 pages!)
• Worst mailbox design (120 columns!)

---

Analysis Date: December 11, 2024

Game #71 of 79 in the Vintage Browser RPG Collection

Status: Feature-complete but architecturally catastrophic

Verdict: Beautiful visuals, ugly code

Nickname: "The Beautiful Monolith" 🖼️📚