Code optimizations across the site. Improved login. Secured database queries. Error page added. Removed unused code and files. Improved logs.

application/API/v1/API_Controller.php

@@ -32,7 +32,7 @@
                 require_once(__DIR__ . "main.php");
             }
             else{
-                $command = strtoupper$pars[1];
+                $command = strtoupper($params[1]);
                 switch ($command){
                     case "log-profile":
                         require_once(__DIR__ . "log-profile/index.php");

application/API/v2/help/api.php

@@ -1,5 +1,7 @@
 <?php
-
+    /**
+     * @var mixed[] $API API help structure.
+     */
     $API = [
         "version" => 2,
         "category" => [

application/API/v2/help/index.php

@@ -5,6 +5,7 @@
      * Shows API documentation.
      *
      * @category View
+     * @var mixed[] $API API help structure.
      */
 ?>
 <?php
@@ -320,7 +321,7 @@
                     foreach ($category["command"] as $command){
 ?>
                         <li>
-                            <a href='#command_<?=$command["name"]?>' alt='<?=$command["description"]?>'>
+                            <a href='#command_<?=$command["name"]?>' title='<?=$command["description"]?>'>
                                 <?=$command["name"]?>
                             </a>
                         </li>

application/API/v2/units.php

@@ -7,9 +7,7 @@
      *  - key: User API key. If not, only public user's unit can be seen.
      *
      * @category API
-     * @magic $params URL parameters:
-     *  1: User ID
-     *  2: Unit ID (optional)
+     * @var mixed[] $params URL parameters.
      */
 
     global $db;

application/API/v2/upload_run_dimension.php

@@ -40,7 +40,6 @@
 
         // Authenticate
         $uid = $json_request->{"wizard_id"};
-        $uname = $json_response->{"wizard_info"}->{"wizard_name"};
         $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND api_key = '$key';";
         if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
             http_response_code(401);

application/API/v2/upload_run_dungeon.php

@@ -40,7 +40,6 @@
 
         // Authenticate
         $uid = $json_request->{"wizard_id"};
-        $uname = $json_response->{"wizard_info"}->{"wizard_name"};
         $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND api_key = '$key';";
         if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
             http_response_code(401);

application/API/v2/upload_run_rift.php

@@ -51,7 +51,6 @@
 
         // Authenticate
         $uid = $json_request->{"wizard_id"};
-        $uname = $json_response->{"wizard_info"}->{"wizard_name"};
         $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND api_key = '$key';";
         if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
             http_response_code(401);

application/API/v2/upload_run_scenario.php

@@ -37,7 +37,6 @@
 
         // Authenticate
         $uid = $json->{"wizard_id"};
-        $uname = $json->{"wizard_info"}->{"wizard_name"};
         $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND api_key = '$key';";
         if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
             http_response_code(401);

application/API/v2/upload_run_toa.php

@@ -40,7 +40,6 @@
 
         // Authenticate
         $uid = $json_request->{"wizard_id"};
-        $uname = $json_response->{"wizard_info"}->{"wizard_name"};
         $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND api_key = '$key';";
         if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
             http_response_code(401);

application/API/v3/help/api.php

@@ -1,5 +1,8 @@
 <?php
 
+    /**
+     * @var mixed[] $API API help structure.
+     */
     $API = [
         "version" => 2,
         "category" => [

application/API/v3/help/index.php

@@ -5,6 +5,7 @@
      * Shows API documentation.
      *
      * @category View
+     * @var mixed[] $API API help structure.
      */
 ?>
 <?php
@@ -313,7 +314,7 @@
                         foreach ($command["method"] as $method){
 ?>
                             <li>
-                                <a href='#command_<?=$command["name"]?>-<?=$method["id"]?>-<?=htmlspecialchars($method["url"])?>' alt='<?=$command["description"]?>'>
+                                <a href='#command_<?=$command["name"]?>-<?=$method["id"]?>-<?=htmlspecialchars($method["url"])?>' title='<?=$command["description"]?>'>
                                     <?=$method["id"]?> <?=htmlspecialchars($method["url"])?>
                                 </a>
                             </li>
@@ -434,7 +435,7 @@
     <?php
                                                     if ($response["example"] != null){
     ?>
-                                                        <span class='fake_a' onclick="showExample('<?=$command["name"]?>', <?=$status["status"]?>, '<?=htmlspecialchars(json_decode($status["example"]), ENT_QUOTES)?>')">
+                                                        <span class='fake_a' onclick="showExample('<?=$command["name"]?>', <?=$response["status"]?>, '<?=htmlspecialchars(json_decode($response["example"]), ENT_QUOTES)?>')">
                                                             View example.
                                                         </span>
     <?php

application/API/v3/profile/DELETE.php

@@ -22,10 +22,11 @@
         header("Content-type: application/json; charset=utf-8");
 
         // Get put data
+        $_DELETE = [];
         parse_str(file_get_contents("php://input"), $_DELETE);
 
         // Get profile ID
-        // $query heredated from API_CONTROLLER
+        /** @var mixed $query Request parameters, from API_CONTROLLER*/
         if (count($query) > 0){
             $id = $query[0];
         }
@@ -46,8 +47,8 @@
 
         // Authenticate
         $statement = $db->prepare("SELECT COUNT(uid) AS c FROM player WHERE uid = :uid AND api_key = :api_key;");
-        $statement->bindValue(":uid", $uid);
-        $statement->bindValue(":api_key", $api_key);
+        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
+        $statement->bindValue(":api_key", $api_key, SQLITE3_TEXT);
         if (1 != $statement->execute()->fetchArray(SQLITE3_ASSOC)["c"]){
             header("HTTP/1.1 401 Invalid credentials.");
             syslog(LOG_INFO, "[APIv3] HTTP/1.1 401 Invalid credentials.");
@@ -60,8 +61,8 @@
             uid = :uid AND
             api_key, = :api_key;
         ");
-        $statement->bindValue(":uid", $uid);
-        $statement->bindValue(":api_key", $api_key);
+        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
+        $statement->bindValue(":api_key", $api_key, SQLITE3_TEXT);
         $statement->execute();
 
         header("HTTP/1.1 204 Profile deleted.");

application/API/v3/profile/GET.php

@@ -21,7 +21,7 @@
         header("Content-type: application/json; charset=utf-8");
 
         // Get profile ID
-        // $query heredated from API_CONTROLLER
+        /** @var mixed $query Request parameters, from API_CONTROLLER*/
         if (count($query) > 1){
             $id = $query[0];
         }
@@ -34,7 +34,7 @@
 
         // Get player
         $statement = $db->prepare("SELECT * FROM player WHERE uid = :uid OR upper(name) = upper(:uid);");
-        $statement->bindValue(":uid", $id);
+        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
         $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
         if ($r == null){
             // No player found

application/API/v3/profile/POST.php

@@ -28,7 +28,7 @@
         parse_str(file_get_contents("php://input"), $_POST);
 
         // Get profile ID
-        // $query heredated from API_CONTROLLER
+        /** @var mixed $query Request parameters, from API_CONTROLLER*/
         if (count($query) > 0){
             $id = $query[0];
         }
@@ -61,7 +61,7 @@
         // Check user name.
         $name = $_POST["name"];
         if ($name == null || $name == false){
-            $name = "player_" . $uid;
+            $name = "player_" . $id;
         }
         // Check user name.
         $public = intval($_POST["public"]);
@@ -71,7 +71,7 @@
 
         // Check if player exists
         $statement = $db->prepare("SELECT COUNT(uid) AS c FROM player WHERE uid = :uid;");
-        $statement->bindValue(":uid", $uid);
+        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
         if (1 != $statement->execute()->fetchArray(SQLITE3_ASSOC)["c"]){
             header("HTTP/1.1 400 Existing user.");
             syslog(LOG_INFO, "[APIv3] HTTP/1.1 400 Existing user.");
@@ -83,7 +83,7 @@
         $characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
         $charactersLength = 16;
         $api_key = "";
-        for ($i = 0; $i < $length; $i++) {
+        for ($i = 0; $i < $charactersLength; $i++) {
             $api_key .= $characters[rand(0, $charactersLength - 1)];
         }
 
@@ -157,38 +157,38 @@
             :public
           );
         ");
-        $statement->bindValue(":uid", $uid);
-        $statement->bindValue(":name", $name);
-        $statement->bindValue(":mail", $mail);
-        $statement->bindValue(":password", $password);
-        $statement->bindValue(":api_key", $api_key);
-        $statement->bindValue(":mana", 0);
-        $statement->bindValue(":crystal", 0);
-        $statement->bindValue(":country", null);
-        $statement->bindValue(":lang", null);
-        $statement->bindValue(":level", 1);
-        $statement->bindValue(":experience", 0);
-        $statement->bindValue(":energy", 0);
-        $statement->bindValue(":energy_max", 0);
-        $statement->bindValue(":energy_per_min", 0);
-        $statement->bindValue(":arena_energy", 0);
-        $statement->bindValue(":arena_energy_max", 10);
-        $statement->bindValue(":rep", null);
-        $statement->bindValue(":social_point", 0);
-        $statement->bindValue(":honor_point", 0);
-        $statement->bindValue(":guild_point", 0);
-        $statement->bindValue(":darkportal_energy", 0);
-        $statement->bindValue(":darkportal_energy_max", 10);
-        $statement->bindValue(":dimension_energy", 0);
-        $statement->bindValue(":dimension_energy_max", 100);
-        $statement->bindValue(":costume_point", 0);
-        $statement->bindValue(":costume_point_max", 0);
-        $statement->bindValue(":honor_medal", 0);
-        $statement->bindValue(":honor_mark", 0);
-        $statement->bindValue(":event_coin", 0);
-        $statement->bindValue(":storage_slots", 0);
-        $statement->bindValue(":island_upgrade", 0);
-        $statement->bindValue(":public", $public);
+        $statement->bindValue(":uid", $id, SQLITE3_INTEGER);
+        $statement->bindValue(":name", $name, SQLITE3_TEXT);
+        $statement->bindValue(":mail", $mail, SQLITE3_TEXT);
+        $statement->bindValue(":password", $password, SQLITE3_TEXT);
+        $statement->bindValue(":api_key", $api_key, SQLITE3_TEXT);
+        $statement->bindValue(":mana", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":crystal", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":country", null, SQLITE3_TEXT);
+        $statement->bindValue(":lang", null, SQLITE3_TEXT);
+        $statement->bindValue(":level", 1, SQLITE3_INTEGER);
+        $statement->bindValue(":experience", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":energy", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":energy_max", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":energy_per_min", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":arena_energy", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":arena_energy_max", 10, SQLITE3_INTEGER);
+        $statement->bindValue(":rep", null, SQLITE3_INTEGER);
+        $statement->bindValue(":social_point", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":honor_point", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":guild_point", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":darkportal_energy", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":darkportal_energy_max", 10, SQLITE3_INTEGER);
+        $statement->bindValue(":dimension_energy", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":dimension_energy_max", 100, SQLITE3_INTEGER);
+        $statement->bindValue(":costume_point", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":costume_point_max", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":honor_medal", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":honor_mark", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":event_coin", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":storage_slots", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":island_upgrade", 0, SQLITE3_INTEGER);
+        $statement->bindValue(":public", $public, SQLITE3_INTEGER);
         $statement->execute();
 
         // Build array

application/API/v3/units.php

@@ -1,108 +0,0 @@
-<?php
-    /**
-     * Unit api.
-     *
-     * Exposes an API to get a list of units of a player, or a unit details.
-     * Used POST parameters are:
-     *  - key: User API key. If not, only public user's unit can be seen.
-     *
-     * @category API
-     * @magic $params URL parameters:
-     *  1: User ID
-     *  2: Unit ID (optional)
-     */
-
-    global $db;
-
-    try{
-
-        if (count($params) <= 1){
-            http_response_code(400);
-            return 400;
-        }
-        $uid = $params[1];
-        $id = null;
-
-        if (count($params) > 2){
-            $id = $params[2];
-        }
-
-        // Check API key or public profile.
-        if (isset($_POST['key'])){
-            $key = filter_input(INPUT_POST, 'key');
-        }
-        else{
-            $key = "";
-        }
-        $s = "SELECT COUNT(uid) AS c FROM player WHERE uid = $uid AND (public = 1 OR api_key = '$key');";
-        if (1 != $db->query($s)->fetchArray(SQLITE3_ASSOC)["c"]){
-            http_response_code(401);
-            return 401;
-        }
-
-        // No unit ID specified, show a list.
-        if ($id == null){
-            $units = [];
-            $s = "SELECT id, '" . URL::BASE . "API/v2/units/$uid/' || id AS uri FROM unit WHERE uid = '$uid'";
-            $q = $db->query($s);
-            $content = false;
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($units, $r);
-                $content = true;
-            }
-            if ($content == true){
-                header('Content-Type: application/json');
-                echo json_encode($units);
-                http_response_code(200);
-                return 200;
-            }
-            else{
-                http_response_code(204);
-                return 204;
-            }
-        }
-
-        // Specific unit, show details.
-        else{
-            $s = "SELECT * FROM unit WHERE uid = '$uid' AND id = '$id'";
-            $q = $db->query($s);
-            if($r = $q->fetchArray(SQLITE3_ASSOC)){
-                $unit = $r;
-
-                // Runes
-                $unit["runes"] = [];
-                $s = "SELECT * FROM rune WHERE assigned_to = '" . $unit["id"] . "' ORDER BY slot;";
-                $q = $db->query($s);
-                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                    $rune = $r;
-                    unset($rune["uid"]); # Not needed
-                    unset($rune["assigned_to"]); # Not needed
-                    array_push($unit["runes"], $rune);
-                }
-
-                // Skills
-                $unit["skills"] = [];
-                $s = "SELECT skill, level FROM unit_skill WHERE unit = '" . $unit["id"] . "';";
-                $q = $db->query($s);
-                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                    array_push($unit["skills"], $r);
-                }
-
-                header('Content-Type: application/json');
-                echo json_encode($unit);
-                http_response_code(200);
-                return 200;
-            }
-            else{
-                http_response_code(404);
-                return 404;
-            }
-        }
-
-    }
-    catch(Exception $e) {
-        error_log("Unknown error fetching units: " . $e->getMessage());
-        http_response_code(500);
-        return 500;
-    }
-?>

application/API/v3/units/GET.php

@@ -15,7 +15,7 @@
     /**
      * Gets info on a unit.
      *
-     * @param SQLiteConn $db Database connection.
+     * @param resource $db Database connection.
      * @param int $id Unit identifier
      * @return mixed[] Content.
      */
@@ -58,7 +58,7 @@
             k_unit.archetype = k_archetype.id AND
             k_unit.id = :id ;
         ");
-        $statement->bindValue(":id", $id);
+        $statement->bindValue(":id", $id, SQLITE3_INTEGER);
         $q = $statement->execute();
         $r = $q->fetchArray(SQLITE3_ASSOC);
         if ($r){
@@ -113,7 +113,7 @@
                     k_leader_skill.area = k_effect_area.id AND
                     k_leader_skill.element = k_element.id;
                 ");
-                $statement_leader->bindValue(":id", $r["leader_skill"]);
+                $statement_leader->bindValue(":id", $r["leader_skill"], SQLITE3_INTEGER);
                 $q_leader = $statement_leader->execute();
                 $r_leader = $q_leader->fetchArray(SQLITE3_ASSOC);
                 if ($r_leader){
@@ -210,7 +210,7 @@
                 k_unit_skill.unit = :id 
               ORDER BY slot;
             ");
-            $statement_skills->bindValue(":id", $id);
+            $statement_skills->bindValue(":id", $id, SQLITE3_INTEGER);
             $q_skills = $statement_skills->execute();
             while ($r_skills = $q_skills->fetchArray(SQLITE3_ASSOC)){
                 $skill = [
@@ -239,7 +239,7 @@
                     skill = :id
                   ORDER BY level;
                 ");
-                $statement_skill_levels->bindValue(":id", $r_skills["id"]);
+                $statement_skill_levels->bindValue(":id", $r_skills["id"], SQLITE3_INTEGER);
                 $q_skill_levels = $statement_skill_levels->execute();
                 while ($r_skill_levels = $q_skill_levels->fetchArray(SQLITE3_ASSOC)){
                     $level = [
@@ -262,7 +262,7 @@
                     k_skill_effect.skill = :id AND
                     k_skill_effect.effect = k_effect.id
                 ");
-                $statement_skill_effects->bindValue(":id", $r_skills["id"]);
+                $statement_skill_effects->bindValue(":id", $r_skills["id"], SQLITE3_INTEGER);
                 $q_skill_effects = $statement_skill_effects->execute();
                 while ($r_skill_effects = $q_skill_effects->fetchArray(SQLITE3_ASSOC)){
                     $effect = [
@@ -288,7 +288,7 @@
     /**
      * Gets a list of units, paginated.
      *
-     * @param SQLiteConn $db Database connection.
+     * @param resource $db Database connection.
      * @return mixed[] Content.
      */
     function get_unit_list($db){
@@ -316,7 +316,7 @@
             if ($filter != null && $filter !== false){
                 $filters[$filter_key] = $filter;
                 // Also, build the new url parameters
-                if ($filter_ley != "page"){
+                if ($filter_key != "page"){
                     $parameters .= ("&" . $filter_key . "=" . $filter);
                 }
             }
@@ -366,12 +366,12 @@
             k_archetype
           WHERE $where ;
         ");
-        $statement->bindValue(":name", "%" . $filters["name"] . "%");
-        $statement->bindValue(":element", $filters["element"]);
-        $statement->bindValue(":archetype", $filters["archetype"]);
-        $statement->bindValue(":stars", $filters["stars"]);
-        $statement->bindValue(":stars_gte", $filters["stars_gte"]);
-        $statement->bindValue(":stars_lte", $filters["stars_lte"]);
+        $statement->bindValue(":name", "%" . $filters["name"] . "%", SQLITE3_TEXT);
+        $statement->bindValue(":element", $filters["element"], SQLITE3_TEXT);
+        $statement->bindValue(":archetype", $filters["archetype"], SQLITE3_TEXT);
+        $statement->bindValue(":stars", $filters["stars"], SQLITE3_INTEGER);
+        $statement->bindValue(":stars_gte", $filters["stars_gte"], SQLITE3_INTEGER);
+        $statement->bindValue(":stars_lte", $filters["stars_lte"], SQLITE3_INTEGER);
         $total = $statement->execute()->fetchArray(SQLITE3_ASSOC)["c"];
 
         // Selet all units
@@ -385,14 +385,14 @@
           LIMIT :limit
           OFFSET :offset ;
         ");
-        $statement->bindValue(":name", "%" . $filters["name"] . "%");
-        $statement->bindValue(":element", $filters["element"]);
-        $statement->bindValue(":archetype", $filters["archetype"]);
-        $statement->bindValue(":stars", $filters["stars"]);
-        $statement->bindValue(":stars_gte", $filters["stars_gte"]);
-        $statement->bindValue(":stars_lte", $filters["stars_lte"]);
-        $statement->bindValue(":limit", $filters["per_page"]);
-        $statement->bindValue(":offset", $filters["per_page"] * ($filters["page"] - 1));
+        $statement->bindValue(":name", "%" . $filters["name"] . "%", SQLITE3_TEXt);
+        $statement->bindValue(":element", $filters["element"], SQLITE3_TEXT);
+        $statement->bindValue(":archetype", $filters["archetype"], SQLITE3_TEXT);
+        $statement->bindValue(":stars", $filters["stars"], SQLITE3_INTEGER);
+        $statement->bindValue(":stars_gte", $filters["stars_gte"], SQLITE3_INTEGER);
+        $statement->bindValue(":stars_lte", $filters["stars_lte"], SQLITE3_INTEGER);
+        $statement->bindValue(":limit", $filters["per_page"], SQLITE3_INTEGER);
+        $statement->bindValue(":offset", $filters["per_page"] * ($filters["page"] - 1), SQLITE3_INTEGER);
         $q = $statement->execute();
         $units = [];
 
@@ -435,7 +435,7 @@
             "content" => ""
         ];
         // Get profile ID
-        // $query heredated from API_CONTROLLER
+        /** @var mixed $query Request parameters, from API_CONTROLLER*/
         if (strlen($query[0]) > 0){
             $id = $query[0];
             $result = get_unit($db, $id);

application/action/delete_team.php

@@ -22,17 +22,16 @@
     function action(){
 
         global $db;
-
         $player = filter_input(INPUT_POST, 'uid');
         $id = filter_input(INPUT_POST, 'id');
         $statement = $db->prepare('DELETE FROM team WHERE uid = :uid AND id = :id;');
-        $statement->bindValue(':uid', $player);
-        $statement->bindValue(':id', $id);
-        $res = $statement->execute();
+        $statement->bindValue(':uid', $player, SQLITE3_INTEGER);
+        $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+        $statement->execute();
         $statement = $db->prepare('DELETE FROM team_unit WHERE team = :id;');
-        $statement->bindValue(':uid', $player);
-        $statement->bindValue(':id', $id);
-        $res = $statement->execute();
+        $statement->bindValue(':uid', $player, SQLITE3_INTEGER);
+        $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+        $statement->execute();
         return 0;
     }
 ?>

application/action/edit_profile.php

@@ -37,8 +37,8 @@
                 return -1;
             }
             $s = $db->prepare('UPDATE player SET mail = :mail WHERE uid = :uid;');
-            $s->bindValue(':uid', $player);
-            $s->bindValue(':mail', $mail);
+            $s->bindValue(':uid', $player, SQLITE3_INTEGER);
+            $s->bindValue(':mail', $mail, SQLITE3_TEXT);
             if(!$s->execute()){
                 return -2;
             }
@@ -48,17 +48,17 @@
             $pass = sha1(filter_input(INPUT_POST, 'pass'));
             $currentPass = sha1(filter_input(INPUT_POST, 'currentPass'));
             $s = $db->prepare('SELECT COUNT(uid) AS count FROM player WHERE uid = :uid AND password = :currentPass;');
-            $s->bindValue(':uid', $player);
-            $s->bindValue(':currentPass', $currentPass);
+            $s->bindValue(':uid', $player, SQLITE3_INTEGER);
+            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
             $q = $s->execute();
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r["count"] != 1){
                 return -3;
             }
             $s = $db->prepare('UPDATE player SET password = :pass WHERE uid = :uid AND password = :currentPass;');
-            $s->bindValue(':uid', $player);
-            $s->bindValue(':pass', $mail);
-            $s->bindValue(':currentPass', $currentPass);
+            $s->bindValue(':uid', $player, SQLITE3_INTEGER);
+            $s->bindValue(':pass', $pass, SQLITE3_TEXT);
+            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
             if(!$s->execute()){
                 return -4;
             }
@@ -68,12 +68,12 @@
             $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
             $charactersLength = 16;
             $api = '';
-            for ($i = 0; $i < $length; $i++) {
+            for ($i = 0; $i < $charactersLength; $i++) {
                 $api .= $characters[rand(0, $charactersLength - 1)];
             }
             $s = $db->prepare('UPDATE player SET api_key = :api WHERE uid = :uid;');
-            $s->bindValue(':uid', $player);
-            $s->bindValue(':api', $api);
+            $s->bindValue(':uid', $player, SQLITE3_INTEGER);
+            $s->bindValue(':api', $api, SQLITE3_TEXT);
             if(!$s->execute()){
                 return -5;
             }

application/action/login.php

@@ -26,21 +26,37 @@
         global $db;
 
         if (!isset($_POST['uname'], $_POST['password'])){
-            return -1;
+            header("Location: " . URL::BASE);
+            exit();
         }
         $uname = SQLite3::escapeString($_POST['uname']);
         if (strlen($uname) == 0){
-            return -2;
+            header("Location: " . URL::BASE);
+            exit();
         }
         $password = SQLite3::escapeString($_POST['password']);
         if (strlen($password) == 0){
-            return -3;
+            header("Location: " . URL::BASE);
+            exit();
         }
         $password = hash('sha256', $password);
-        $q = $db->query("SELECT uid FROM player;");
-        $r = $q->fetchArray(SQLITE3_ASSOC);
+        $statement = $db->prepare("
+          SELECT uid 
+          FROM player 
+          WHERE
+            upper(name) = upper(:name) AND 
+            password = :password;
+        ");
+        $statement->bindValue(":name", $uname, SQLITE3_TEXT);
+        $statement->bindValue(":password", $password, SQLITE3_TEXT);
+        $statement->execute();
+        $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
         if (!$r){
-            return -4;
+            error_log("REDIRECT TO:" . URL::BASE);
+            header("Location: " . URL::BASE);
+            exit();
+            die();
+            return 401;
         }
         $uid = $r["uid"];
         setcookie("uid", $uid, time() + 5 * 24 * 60 * 60); // 5 Days
@@ -48,7 +64,8 @@
         $_SESSION['session'] = true;
         $_SESSION['name'] = $uname;
         $_SESSION['uid'] = $uid;
-        header("Location: /$uid/");
+        header("Location: " . URL::BASE . "/$uid/");
+        exit();
         die();
         return 0;
     }

application/action/logout.php

@@ -18,8 +18,7 @@
      * @global int The user id.
      */
     function action(){
-        global $UID;
-        $UID = null;
+        $GLOBALS["UID"] = null;
         setcookie("uid", null, time() - 3600);
         session_regenerate_id();
         $_SESSION['session'] = false;

application/action/new_team.php

@@ -172,15 +172,15 @@
         $r = $q->fetchArray(SQLITE3_ASSOC);
         $team_id = $r["id"];
         $statement = $db->prepare('INSERT INTO team (uid, id, name, description, area_type, area, stage, difficulty, score) VALUES (:uid, :id, :name, :description, :area_type, :area, :stage, :difficulty, :score);');
-        $statement->bindValue(':uid', $player);
-        $statement->bindValue(':id', $team_id);
-        $statement->bindValue(':name', $name);
-        $statement->bindValue(':description', $description);
-        $statement->bindValue(':area_type', $area_type);
-        $statement->bindValue(':area', $area);
-        $statement->bindValue(':stage', $stage);
-        $statement->bindValue(':difficulty', $difficulty);
-        $statement->bindValue(':score', $score);
+        $statement->bindValue(':uid', $player, SQLITE3_INTEGER);
+        $statement->bindValue(':id', $team_id, SQLITE3_INTEGER);
+        $statement->bindValue(':name', $name, SQLITE3_TEXT);
+        $statement->bindValue(':description', $description, SQLITE3_TEXT);
+        $statement->bindValue(':area_type', $area_type, SQLITE3_INTEGER);
+        $statement->bindValue(':area', $area, SQLITE3_INTEGER);
+        $statement->bindValue(':stage', $stage, SQLITE3_INTEGER);
+        $statement->bindValue(':difficulty', $difficulty, SQLITE3_INTEGER);
+        $statement->bindValue(':score', $score, SQLITE3_INTEGER);
         $res = $statement->execute();
         if (!$res){
             return -5;
@@ -196,7 +196,14 @@
             if ($j < $total_front){
                 $front = 1;
             }
-            $s = "INSERT INTO team_unit VALUES ($team_id, $i, $leader, $front);";
+            $statement = $db->prepare("
+              INSERT INTO team_unit (team, unit, leader, front)
+              VALUES (:team, :unit, :leader, :front);
+            ");
+            $statement->bindValue(':team', $team_id, SQLITE3_INTEGER);
+            $statement->bindValue(':unit', $i, SQLITE3_INTEGER);
+            $statement->bindValue(':leader', $leader, SQLITE3_INTEGER);
+            $statement->bindValue(':front', $front, SQLITE3_INTEGER);
             $db->query($s);
             $j ++;
         }

application/action/optimize_get_options.php

@@ -21,12 +21,9 @@
      * @return int|string 0 on success, negative values on error. If the API
      * key has been updated, the new key.
      * @category Action
-     * @global resource Database connection.
      */
     function action(){
 
-        global $db;
-
         // Increase max execution time.
         set_time_limit(60);
         
@@ -109,7 +106,7 @@
                         break;
                 }
                 $stat_values = [
-                    $rune->main_stat_value,
+                    $main_value,
                     $rune->innate_stat_value,
                     $rune->substat_1_value + $rune->substat_1_craft,
                     $rune->substat_2_value + $rune->substat_2_craft,

application/action/optimize_get_rune_list.php

@@ -26,8 +26,6 @@
     function action(){
 
         global $db;
-        
-        $HARD_LIMIT = 100;
 
         // Increase max execution time.
         set_time_limit(60);
@@ -40,8 +38,6 @@
             5 => [],
             6 => []
         ];
-        
-        $options = [];
 
         $response = null;
 
@@ -84,19 +80,6 @@
         if ($tuning == null){
             return -6;
         }
-        
-        $min = [
-            "attack" => intval(filter_input(INPUT_POST, 'min_attack')),
-            "defense" => intval(filter_input(INPUT_POST, 'min_defense')),
-            "hp" => intval(filter_input(INPUT_POST, 'min_hp')),
-            "speed" => intval(filter_input(INPUT_POST, 'min_speed')),
-            "crit_rate" => intval(filter_input(INPUT_POST, 'min_crit_rate')),
-            "crit_damage" => intval(filter_input(INPUT_POST, 'min_crit_damage')),
-            "accuracy" => intval(filter_input(INPUT_POST, 'min_accuracy')),
-            "resistance" => intval(filter_input(INPUT_POST, 'min_resistance')),
-            "ehp" => intval(filter_input(INPUT_POST, 'min_ehp')),
-            "dmg" => intval(filter_input(INPUT_POST, 'min_dmg'))
-        ];
 
         // Instantiate the unit
         $unit = new Unit($unit_id, true, $uid);
@@ -123,7 +106,7 @@
             substat_4_value + substat_4_grind AS substat_4_value
           FROM rune
           WHERE
-            uid = $uid AND
+            uid = :uid AND
             type IN (
         ";
         foreach ($sets as $set){
@@ -134,14 +117,14 @@
             case 0: // Storage only (or itself)
                 $base_s .= "
                   (
-                    assigned_to = $unit_id OR
+                    assigned_to = :unit_id OR
                     assigned_to IS NULL
                   )";
                 break;
             case 1: // Units in no teams (or itself)
                 $base_s .= "
                   (
-                    assigned_to = $unit_id OR
+                    assigned_to = :unit_id OR
                     assigned_to IS NULL OR 
                     assigned_to NOT IN (SELECT DISTINCT unit FROM team_unit)
                   )
@@ -150,7 +133,7 @@
             case 2: // Units in teams with 0 score (or itself)
                 $base_s .= "
                   (
-                    assigned_to = $unit_id OR
+                    assigned_to = :unit_id OR
                     assigned_to IS NULL OR 
                     assigned_to NOT IN (SELECT DISTINCT unit FROM team_unit) OR
                     assigned_to NOT IN (
@@ -175,7 +158,7 @@
                 $base_s .= " 1 = 0 ";
         }
         $s_order = " ORDER BY stars DESC, original_quality DESC, max_efficiency DESC, efficiency DESC, level DESC";
-        $s_in = " main_stat IN (" . $stats[0] . ", " . $stats[1] . ", " . $stats[2] . ") ";
+        $s_in = " main_stat IN (:stat_0, :stat_1, :stat_2) ";
 
         $s = ["", "", "", "", "", "", ""];
         $s[1] = $base_s . " AND slot = 1 " . $s_order;
@@ -187,7 +170,13 @@
 
         $total_candidates = 0;
         for ($i = 1; $i <= 6; $i ++){
-            $q = $db->query($s[$i]);
+            $statement = $db->prepare($s[$i]);
+            $statement->bindValue(':uid', $uid, SQLITE3_INTEGER);
+            $statement->bindValue(':unit_id', $unit_id, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_0', $stats[0], SQLITE3_INTEGER);
+            $statement->bindValue(':stat_1', $stats[1], SQLITE3_INTEGER);
+            $statement->bindValue(':stat_2', $stats[2], SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 $rune = create_rune_array($unit, $r, $tuning);
                 //array_push($candidates[$i], new Rune($r["id"]));
@@ -195,7 +184,7 @@
                 $total_candidates ++;
             }
         }
-        $max_combinations = sizeof($candidates[1]) * sizeof($candidates[2]) * sizeof($candidates[3]) * sizeof($candidates[4]) * sizeof($candidates[5]) * sizeof($candidates[6]);
+        //$max_combinations = sizeof($candidates[1]) * sizeof($candidates[2]) * sizeof($candidates[3]) * sizeof($candidates[4]) * sizeof($candidates[5]) * sizeof($candidates[6]);
         
         // TODO: Build response
         $response = json_encode($candidates);
@@ -211,7 +200,7 @@
      * Creates an array with the stats provided by a rune on a unit.
      *
      * @param Unit $unit Target unit.
-     * @param SQLResult $r Rune main stat ID.
+     * @param int $r Rune main stat ID.
      * @param int $stars Rune stars.
      * @return int Value of the main stat at the selected level.
      */

application/action/rate_team.php

@@ -23,14 +23,20 @@
      */
     function action(){
         global $db;
-        $player = filter_input(INPUT_GET, 'uid');
-        $team = filter_input(INPUT_GET, 'team');
-        $score = intval(filter_input(INPUT_GET, 'score'));
-        $statement = $db->prepare('UPDATE team SET score = :score WHERE uid = :uid AND id = :team;');
-        $statement->bindValue(':score', $score);
-        $statement->bindValue(':uid', $player);
-        $statement->bindValue(':team', $team);
-        $res = $statement->execute();
+        $player = filter_input(INPUT_GET, "uid");
+        $team = filter_input(INPUT_GET, "team");
+        $score = intval(filter_input(INPUT_GET, "score"));
+        $statement = $db->prepare("
+          UPDATE team
+          SET score = :score
+          WHERE
+            uid = :uid AND
+            id = :team;
+        ");
+        $statement->bindValue(":score", $score, SQLITE3_INTEGER);
+        $statement->bindValue(":uid", $player, SQLITE3_INTEGER);
+        $statement->bindValue(":team", $team, SQLITE3_INTEGER);
+        $statement->execute();
         return 0;
     }
 ?>

application/action/save_run_team.php

@@ -34,22 +34,37 @@
         $q = $db->query($s);
         $r = $q->fetchArray(SQLITE3_ASSOC);
         $team_id = $r["id"];
-        $s = "SELECT run.area AS area, run.stage AS stage, run.difficulty AS difficulty, k_area.type AS area_type FROM run, k_area WHERE run.uid = '$player' AND run.id = '$run' AND k_area.id = run.area AND run.helper = 0;";
-        $q = $db->query($s);
-        $r = $q->fetchArray(SQLITE3_ASSOC);
+        $statement = $db->prepare("
+          SELECT
+            run.area AS area,
+            run.stage AS stage,
+            run.difficulty AS difficulty,
+            k_area.type AS area_type
+          FROM
+            run,
+            k_area
+          WHERE
+            run.uid = :uid AND
+            run.id = :run AND
+            k_area.id = run.area AND
+            run.helper = 0;
+        ");
+        $statement->bindValue(':uid', $player, SQLITE3_INTEGER);
+        $statement->bindValue(':run', $run, SQLITE3_INTEGER);
+        $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
         if (!$r){
             return -2;
         }
         $statement = $db->prepare('INSERT INTO team (uid, id, name, description, area_type, area, stage, difficulty, score) VALUES (:uid, :id, :name, :description, :area_type, :area, :stage, :difficulty, :score);');
-        $statement->bindValue(':uid', $player);
-        $statement->bindValue(':id', $team_id);
-        $statement->bindValue(':name', $name);
-        $statement->bindValue(':description', $description);
-        $statement->bindValue(':area_type', $r["area_type"]);
-        $statement->bindValue(':area', $r["area"]);
-        $statement->bindValue(':stage', $r["stage"]);
-        $statement->bindValue(':difficulty', $r["difficulty"]);
-        $statement->bindValue(':score', $score);
+        $statement->bindValue(':uid', $player, SQLITE3_INTEGER);
+        $statement->bindValue(':id', $team_id, SQLITE3_INTEGER);
+        $statement->bindValue(':name', $name, SQLITE3_TEXT);
+        $statement->bindValue(':description', $description, SQLITE3_TEXT);
+        $statement->bindValue(':area_type', $r["area_type"], SQLITE3_INTEGER);
+        $statement->bindValue(':area', $r["area"], SQLITE3_INTEGER);
+        $statement->bindValue(':stage', $r["stage"], SQLITE3_INTEGER);
+        $statement->bindValue(':difficulty', $r["difficulty"], SQLITE3_INTEGER);
+        $statement->bindValue(':score', 0, SQLITE3_INTEGER);
         $res = $statement->execute();
         if (!$res){
             return -3;
@@ -57,8 +72,13 @@
         $s = "SELECT unit FROM run_party WHERE run = $run AND unit IS NOT NULL;";
         $q = $db->query($s);
         while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-            $s = "INSERT INTO team_unit VALUES ('$team_id', '" . $r["unit"] . "');";
-            $db->query($s);
+            $statement = $db->prepare("
+              INSERT INTO team_unit (team, unit)
+              VALUES (:team, :unit)
+            ");
+            $statement->bindValue(':team', $team_id, SQLITE3_INTEGER);
+            $statement->bindValue(':unit', $r["unit"], SQLITE3_INTEGER);
+            $statement->execute();
         }
         return 0;
     }

application/entity/Artifact.php

@@ -65,14 +65,14 @@
         /**
          * @var int Artifact quality.
          *
-         * @see QUALITY
+         * @see QUALITY_ID
          */
         public $quality;
 
         /**
          * @var int Artifact original quality.
          *
-         * @see QUALITY
+         * @see QUALITY_ID
          */
         public $original_quality;
 
@@ -201,41 +201,42 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  assigned_to, " .
-              "  type, " .
-              "  attribute, " .
-              "  archetype, " .
-              "  level, " .
-              "  quality, " .
-              "  original_quality, " .
-              "  value, " .
-              "  efficiency, " .
-              "  max_efficiency, " .
-              "  main_stat, " .
-              "  main_stat_value, " .
-              "  effect_1, " .
-              "  effect_1_value, " .
-              "  effect_1_enchant, " .
-              "  effect_1_grind, " .
-              "  effect_2, " .
-              "  effect_2_value, " .
-              "  effect_2_enchant, " .
-              "  effect_2_grind, " .
-              "  effect_3, " .
-              "  effect_3_value, " .
-              "  effect_3_enchant, " .
-              "  effect_3_grind, " .
-              "  effect_4, " .
-              "  effect_4_value, " .
-              "  effect_4_enchant, " .
-              "  effect_4_grind " .
-              "FROM artifact " .
-              "WHERE id = '$id'; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                assigned_to,
+                type,
+                attribute,
+                archetype,
+                level,
+                quality,
+                original_quality,
+                value,
+                efficiency,
+                max_efficiency,
+                main_stat,
+                main_stat_value,
+                effect_1,
+                effect_1_value,
+                effect_1_enchant,
+                effect_1_grind,
+                effect_2,
+                effect_2_value,
+                effect_2_enchant,
+                effect_2_grind,
+                effect_3,
+                effect_3_value,
+                effect_3_enchant,
+                effect_3_grind,
+                effect_4,
+                effect_4_value,
+                effect_4_enchant,
+                effect_4_grind
+              FROM artifact
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->assigned_to = $r["assigned_to"];
@@ -252,20 +253,12 @@
                 $this->main_stat_value = $r["main_stat_value"];
                 $this->effect_1 = $r["effect_1"];
                 $this->effect_1_value = $r["effect_1_value"];
-                //$this->effect_1_enchant = $r["effect_1_enchant"];
-                //$this->effect_1_grind = $r["effect_1_grind"];
                 $this->effect_2 = $r["effect_2"];
                 $this->effect_2_value = $r["effect_2_value"];
-                //$this->effect_2_enchant = $r["effect_2_enchant"];
-                //$this->effect_2_grind = $r["effect_2_grind"];
                 $this->effect_3 = $r["effect_3"];
                 $this->effect_3_value = $r["effect_3_value"];
-                //$this->effect_3_enchant = $r["effect_3_enchant"];
-                //$this->effect_3_grind = $r["effect_3_grind"];
                 $this->effect_4 = $r["effect_4"];
                 $this->effect_4_value = $r["effect_4_value"];
-                //$this->effect_4_enchant = $r["effect_4_enchant"];
-                //$this->effect_4_grind = $r["effect_4_grind"];
                 $this->refresh_names();
             }
         }
@@ -314,12 +307,13 @@
 
             global $db;
 
-            $s =
-              "SELECT name " .
-              "FROM k_artifact_effect " .
-              "WHERE id = '$effect'; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT name
+              FROM k_artifact_effect
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $effect, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 return str_replace("{}", $value, $r["name"]);
             }

application/entity/Building.php

@@ -51,19 +51,21 @@
 
             global $db;
 
-            $s = "
-                SELECT
-                  uid,
-                  building,
-                  gain
-                FROM building
-                WHERE id = $id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->uid = $r["uid"];
-            $this->building = new K_Building($r["building"]);
-            $this->gain = $r["gain"];
+            $statement = $db->prepare("
+              SELECT
+                uid,
+                building,
+                gain
+              FROM building
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->uid = $r["uid"];
+                $this->building = new K_Building($r["building"]);
+                $this->gain = $r["gain"];
+            }
         }
     }
 ?>

application/entity/Decoration.php

@@ -50,19 +50,21 @@
 
             global $db;
 
-            $s = "
-                SELECT
-                  uid,
-                  decoration,
-                  level
-                FROM decoration
-                WHERE id = $id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->uid = $r["uid"];
-            $this->decoration = new K_Decoration($r["decoration"]);
-            $this->level = $r["level"];
+            $statement = $db->prepare("
+              SELECT
+                uid,
+                decoration,
+                level
+              FROM decoration
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->uid = $r["uid"];
+                $this->decoration = new K_Decoration($r["decoration"]);
+                $this->level = $r["level"];
+            }
         }
     }
 ?>

application/entity/Enchantment.php

@@ -35,7 +35,7 @@
         /**
          * @var int Item quality.
          *
-         * @see QUALITY
+         * @see QUALITY_ID
          */
         public $quality;
 
@@ -52,7 +52,7 @@
         /**
          * @var int Stat the item modifies.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $stat;
 
@@ -114,7 +114,7 @@
 
             global $db;
 
-            $s = "
+            $statement = $db->prepare("
               SELECT
                 enchantment.id AS id,
                 enchantment.quality As quality,
@@ -133,16 +133,16 @@
                 k_enchantment_type,
                 k_enchantment_range
               WHERE
-                enchantment.id = $id AND
+                enchantment.id = :id AND
                 enchantment.type = k_enchantment_type.id AND
                 k_enchantment_type.gem = k_enchantment_range.gem AND
                 k_enchantment_type.gem = k_enchantment_range.gem AND
                 k_enchantment_type.ancient = k_enchantment_range.ancient AND
                 enchantment.quality = k_enchantment_range.quality AND
                 enchantment.stat = k_enchantment_range.stat;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->gem = $r["gem"];

application/entity/Fusion.php

@@ -40,21 +40,23 @@
         public function __construct($id, $uid){
             global $db;
             parent::__construct($id, true);
-            $s = "
+            $statement = $db->prepare("
               SELECT unit.id AS id
               FROM
                 unit,
                 k_unit
               WHERE
                 k_unit.id = unit.unit AND
-                unit.uid = '$uid' AND
+                unit.uid = :uid AND
                 (
-                  k_unit.id = $id OR
-                  k_unit.awakens_from = $id OR
-                  k_unit.awakens_to = $id
+                  k_unit.id = :id OR
+                  k_unit.awakens_from = :id OR
+                  k_unit.awakens_to = :id
                 );
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $uid, SQLITE3_INTEGER);
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->owned, new Unit($r["id"], false));
             }
@@ -125,7 +127,7 @@
 
             global $db;
 
-            $s = "
+            $statement = $db->prepare("
               SELECT DISTINCT
                 product,
                 stars,
@@ -135,18 +137,18 @@
                 product = $id OR
                 product = (SELECT awakens_to FROM k_unit WHERE id = $id) OR
                 product = (SELECT awakens_from FROM k_unit WHERE id = $id);
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             $this->product = new Monster_Fusion($r["product"], $uid);
             $this->product_awaken = new Monster_Fusion($this->product->awakens_to, $uid);
             $this->stars = $r["stars"];
             $this->cost = $r["cost"];
-            $s_f = "
+            $statement = $db->prepare("
               SELECT DISTINCT ingredient
               FROM k_fusion
               WHERE
-                product = " . $this->product->id . " AND
+                product = :product AND
                 ingredient IN (
                   SELECT DISTINCT k_unit.id
                   FROM
@@ -157,34 +159,37 @@
                     k_fusion.product = k_unit.awakens_to OR
                     k_fusion.product = k_unit.id
                 );
-            ";
-            $q_f = $db->query($s_f);
+            ");
+            $statement->bindValue(':product', $this->product->id, SQLITE3_INTEGER);
+            $q_f = $statement->execute();
             while ($r_f = $q_f->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->fusion, new Fusion($r_f["ingredient"], $uid));
             }
-            $s_m =
-              "SELECT  " .
-              "  id, " .
-              "  awakens_from " .
-              "FROM k_unit " .
-              "WHERE id IN ( " .
-              "  SELECT DISTINCT " .
-              "    ingredient " .
-              "  FROM k_fusion " .
-              "  WHERE  " .
-              "    product = " . $this->product->id . " AND " .
-              "    ingredient NOT IN (  " .
-              "      SELECT DISTINCT k_unit.id  " .
-              "      FROM  " .
-              "        k_fusion,  " .
-              "        k_unit  " .
-              "      WHERE " .
-              "        k_fusion.product = k_unit.awakens_from OR " .
-              "        k_fusion.product = k_unit.awakens_to OR " .
-              "        k_fusion.product = k_unit.id " .
-              "    ) " .
-              "  ); ";
-            $q_m = $db->query($s_m);
+            $statement = $db->prepare("
+              SELECT 
+                id,
+                awakens_from
+              FROM k_unit
+              WHERE id IN (
+                SELECT DISTINCT
+                  ingredient
+                FROM k_fusion
+                WHERE 
+                  product = :product AND
+                  ingredient NOT IN ( 
+                    SELECT DISTINCT k_unit.id 
+                    FROM 
+                      k_fusion, 
+                      k_unit 
+                    WHERE
+                      k_fusion.product = k_unit.awakens_from OR
+                      k_fusion.product = k_unit.awakens_to OR
+                      k_fusion.product = k_unit.id
+                  )
+                );
+            ");
+            $statement->bindValue(':product', $this->product->id, SQLITE3_INTEGER);
+            $q_m = $statement->execute();
             while ($r_m = $q_m->fetchArray(SQLITE3_ASSOC)){
                 $m = new Monster_Fusion($r_m["id"], $uid);
                 array_push($this->ingredient, $m);

application/entity/Guild.php

@@ -85,21 +85,23 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  name, " .
-              "  level, " .
-              "              experience, " .
-              "  recruiting, " .
-              "  members, " .
-              "  leader, " .
-              "  comment, " .
-              "  notice " .
-              "FROM guild " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                name,
+                level,
+                experience,
+                recruiting,
+                members,
+                leader,
+                comment,
+                notice
+              FROM guild
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
@@ -112,16 +114,18 @@
                 $this->comment = HTML::e($r["comment"]);
                 $this->notice = HTML::e($r["notice"]);
             }
-            $s =
-              "SELECT id " .
-              "FROM guild_member " .
-              "WHERE guild = $this->id " .
-              "ORDER BY " .
-              "  grade = 1 DESC, " .
-              "  grade = 3 DESC, " .
-              "  grade = 2 DESC, " .
-              "  arena_score DESC; ";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT id
+              FROM guild_member
+              WHERE guild = :guild
+              ORDER BY
+                grade = 1 DESC,
+                grade = 3 DESC,
+                grade = 2 DESC,
+                arena_score DESC;
+            ");
+            $statement->bindValue(':guild', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->members, new Guild_Member($r["id"]));
             }

application/entity/Guild_Member.php

@@ -90,23 +90,24 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  guild, " .
-              "  name, " .
-              "  level, " .
-              "  grade, " .
-              "  rating, " .
-              "  arena_score, " .
-              "  joined, " .
-              "  last_login, " .
-              "  in_war, " .
-              "  has_defense " .
-              "FROM guild_member " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                guild,
+                name,
+                level,
+                grade,
+                rating,
+                arena_score,
+                joined,
+                last_login,
+                in_war,
+                has_defense
+              FROM guild_member
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->guild = $r["guild"];

application/entity/Inventory.php

@@ -82,26 +82,30 @@
                   inventory.type = k_inventory_type.id AND
                   inventory.id = k_inventory.id AND
                   inventory.type = k_inventory.type AND
-                  inventory.id = $id
+                  inventory.id = :id
             ";
             if ($type != null){
-                $s .= "AND inventory.type = $type";
+                $s .= "AND inventory.type = :type";
             }
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->type = $r["type"];
-            $this->amount = $r["amount"];
-            if ($r["type"] == INVENTORY_TYPE_ID::GUILD_MONSTER_PIECE || $r["type"] == INVENTORY_TYPE_ID::MONSTER_PIECE){
-                $this->is_monster_pices = true;
-                $this->id = new K_Unit($r["id"]);
-                $this->name = HTML::e($this->id->title) . " Pieces";
-                $this->description = HTML::e($this->id->title) . " Pieces";
-            }
-            else{
-                $this->is_monster_pices = false;
-                $this->id = $r["id"];
-                $this->name = HTML::e($r["name"]);
-                $this->description = HTML::e($r["description"]);
+            $statement = $db->prepare($s);
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $statement->bindValue(':type', $type, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->type = $r["type"];
+                $this->amount = $r["amount"];
+                if ($r["type"] == INVENTORY_TYPE_ID::GUILD_MONSTER_PIECE || $r["type"] == INVENTORY_TYPE_ID::MONSTER_PIECE){
+                    $this->is_monster_pices = true;
+                    $this->id = new K_Unit($r["id"]);
+                    $this->name = HTML::e($this->id->title) . " Pieces";
+                    $this->description = HTML::e($this->id->title) . " Pieces";
+                }
+                else{
+                    $this->is_monster_pices = false;
+                    $this->id = $r["id"];
+                    $this->name = HTML::e($r["name"]);
+                    $this->description = HTML::e($r["description"]);
+                }
             }
         }
 

application/entity/K_Area.php

@@ -53,19 +53,20 @@
 
             $this->id = $id;
             $this->type = $type;
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   id,
                   type,
                   name
                 FROM k_area
                 WHERE
-                  id = '$id' AND
-                  type = '$type' 
-                ORDER BY type = '$type' DESC;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+                  id = :id AND
+                  type = :type
+                ORDER BY type DESC;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $statement->bindValue(':type', $type, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->name = HTML::e($r["name"]);
             }
@@ -74,13 +75,12 @@
                 $this->name = "Hall of Heroes";
             }
             else{
-                $s = "
+                $statement = $db->prepare("
                   SELECT name
                   FROM k_area_type
-                  WHERE id = '$type'
-                ";
-                $q = $db->query($s);
-                $r = $q->fetchArray(SQLITE3_ASSOC);
+                  WHERE id = :type;
+                ");
+                $statement->bindValue(':type', $type, SQLITE3_INTEGER);
                 if ($r){
                     $this->name = HTML::e($r["name"]);
                 }

application/entity/K_Building.php

@@ -50,15 +50,16 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  description " .
-              "FROM k_building " .
-              "WHERE id = '$id'; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                description
+              FROM k_building
+               WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);

application/entity/K_Decoration.php

@@ -80,7 +80,7 @@
 
             global $db;
 
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   id,
                   name,
@@ -90,10 +90,10 @@
                   element,
                   max_level
                 FROM k_decoration
-                WHERE id = $id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+               WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);
@@ -102,15 +102,16 @@
                 $this->stat = $r["affected_stat"];
                 $this->element = $r["element"];
                 $this->max_level = $r["max_level"];
-                $s = "
+                $statement = $db->prepare("
                     SELECT
                       level,
                       bonus,
                       cost
                     FROM k_decoration_level
-                    WHERE decoration = $id
-                ";
-                $q = $db->query($s);
+                    WHERE decoration = :id
+                ");
+                $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+                $q = $statement->execute();
                 while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                     $this->level_bonus[$r["level"]] = $r["bonus"];
                     $this->level_cost[$r["level"]] = $r["cost"];

application/entity/K_Effect.php

@@ -54,16 +54,17 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  is_buff, " .
-              "  description " .
-              "FROM k_effect " .
-              "WHERE id = $id;";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                is_buff,
+                description
+              FROM k_effect
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);

application/entity/K_Guild_Skill.php

@@ -54,16 +54,17 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  skill_group, " .
-              "  level, " .
-              "  effect " .
-              "FROM k_guild_skill " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                skill_group,
+                level,
+                effect
+              FROM k_guild_skill
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->group = $r["skill_group"];

application/entity/K_Guild_Skill_Group.php

@@ -55,27 +55,30 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  description " .
-              "FROM k_guild_skill_group " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                description
+              FROM k_guild_skill_group
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);
                 $this->description = HTML::e($r["description"]);
-            }
-            $s =
-              "SELECT id " .
-              "FROM k_guild_skill " .
-              "WHERE skill_group = $this->id; ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($this->skills, new K_Guild_Skill($r["id"]));
+                $statement = $db->prepare("
+                  SELECT id
+                  FROM k_guild_skill
+                  WHERE skill_group = :id;
+                ");
+                $statement->bindValue(':id', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    array_push($this->skills, new K_Guild_Skill($r["id"]));
+                }
             }
         }
 

application/entity/K_Inventory.php

@@ -54,27 +54,31 @@
         public function __construct($id, $type = null){
             global $db;
             $s = "
-                SELECT
-                  k_inventory.id AS id,
-                  k_inventory.name AS name,
-                  k_inventory.description AS description,
-                  k_inventory_type.name AS type
-                FROM
-                  k_inventory,
-                  k_inventory_type
-                WHERE
-                  k_inventory.type = k_inventory_type.id AND
-                  k_inventory.id = $id
+              SELECT
+                k_inventory.id AS id,
+                k_inventory.name AS name,
+                k_inventory.description AS description,
+                k_inventory_type.name AS type
+              FROM
+                k_inventory,
+                k_inventory_type
+              WHERE
+                k_inventory.type = k_inventory_type.id AND
+                k_inventory.id = :id
             ";
             if ($type != null){
-                $s .= "AND k_inventory.type = $type";
+                $s .= "AND k_inventory.type = :type";
+            }
+            $statement = $db->prepare($s);
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $statement->bindValue(':type', $type, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->type = $r["type"];
+                $this->id = $r["id"];
+                $this->name = HTML::e($r["name"]);
+                $this->description = HTML::e($r["description"]);
             }
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->type = $r["type"];
-            $this->id = $r["id"];
-            $this->name = HTML::e($r["name"]);
-            $this->description = HTML::e($r["description"]);
         }
 
         /**

application/entity/K_Leader_Skill.php

@@ -59,22 +59,25 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  stat, " .
-              "  amount, " .
-              "  area, " .
-              "  element " .
-              "FROM k_leader_skill " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->id = $r["id"];
-            $this->attribute = $r["stat"];
-            $this->amount = $r["amount"];
-            $this->area = $r["area"];
-            $this->element = $r["element"]; 
+            $statement = $db->prepare("
+              SELECT
+                id,
+                stat,
+                amount,
+                area,
+                element
+              FROM k_leader_skill
+             WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->id = $r["id"];
+                $this->attribute = $r["stat"];
+                $this->amount = $r["amount"];
+                $this->area = $r["area"];
+                $this->element = $r["element"];
+            }
         }
 
         /**

application/entity/K_Rune_Set.php

@@ -54,16 +54,17 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  amount, " .
-              "  description " .
-              "FROM k_rune_set " .
-              "WHERE id = $id;";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                amount,
+                description
+              FROM k_rune_set
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);

application/entity/K_Skill.php

@@ -102,50 +102,57 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  description, " .
-              "  slot, " .
-              "  cooltime, " .
-              "  hits, " .
-              "  passive, " .
-              "  aoe, " .
-              "  max_level, " .
-              "  multiplier_formula " .
-              "FROM k_skill " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->id = $r["id"];
-            $this->name = HTML::e($r["name"]);
-            $this->description = HTML::e($r["description"]);
-            $this->slot = $r["slot"];
-            $this->cooltime = $r["cooltime"];
-            $this->hits = $r["hits"];
-            $this->passive = $r["passive"];
-            $this->aoe = $r["aoe"];
-            $this->max_level = $r["max_level"];
-            $this->multiplier_formula = HTML::e($r["multiplier_formula"]);
-            $s =
-              "SELECT " .
-              "  skill, " .
-              "  level " .
-              "FROM k_skill_level " .
-              "WHERE skill = " . $this->id . " " .
-              "ORDER BY level; ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($this->level, new K_Skill_Level($r["skill"], $r["level"]));
-            }
-            $s =
-              "SELECT DISTINCT effect " .
-              "FROM k_skill_effect " .
-              "WHERE skill = " . $this->id . "; ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($this->effect, new K_Effect($r["effect"]));
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                description,
+                slot,
+                cooltime,
+                hits,
+                passive,
+                aoe,
+                max_level,
+                multiplier_formula
+              FROM k_skill
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->id = $r["id"];
+                $this->name = HTML::e($r["name"]);
+                $this->description = HTML::e($r["description"]);
+                $this->slot = $r["slot"];
+                $this->cooltime = $r["cooltime"];
+                $this->hits = $r["hits"];
+                $this->passive = $r["passive"];
+                $this->aoe = $r["aoe"];
+                $this->max_level = $r["max_level"];
+                $this->multiplier_formula = HTML::e($r["multiplier_formula"]);
+                $statement = $db->prepare("
+                  SELECT
+                    skill,
+                    level
+                  FROM k_skill_level
+                  WHERE skill = :skill
+                  ORDER BY level;
+                ");
+                $statement->bindValue(':skill', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    array_push($this->level, new K_Skill_Level($r["skill"], $r["level"]));
+                }
+                $statement = $db->prepare("
+                  SELECT DISTINCT effect
+                  FROM k_skill_effect
+                  WHERE skill = :skill;
+                ");
+                $statement->bindValue(':skill', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    array_push($this->effect, new K_Effect($r["effect"]));
+                }
             }
         }
 

application/entity/K_Skill_Level.php

@@ -50,17 +50,19 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  skill, " .
-              "  level, " .
-              "  description " .
-              "FROM k_skill_level " .
-              "WHERE " .
-              "  skill = $skill AND " .
-              "  level = $level;";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                skill,
+                level,
+                description
+              FROM k_skill_level
+              WHERE
+                skill = :skill AND
+                level = :level;
+            ");
+            $statement->bindValue(':skill', $skill, SQLITE3_INTEGER);
+            $statement->bindValue(':level', $level, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->skill = $r["skill"];
                 $this->level = $r["level"];

application/entity/K_Source.php

@@ -53,16 +53,17 @@
          */
         public function __construct($id){
             global $db;
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  name, " .
-              "  description, " .
-              "  farmable " .
-              "FROM k_source " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                name,
+                description,
+                farmable
+              FROM k_source
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->name = HTML::e($r["name"]);

application/entity/K_Unit.php

@@ -192,7 +192,7 @@
         public $craft_cost;
 
         /**
-         * @var \K_Unit_Skill[] Unit skills.
+         * @var \K_Skill[] Unit skills.
          */
         public $skill = [];
 
@@ -236,44 +236,45 @@
          */
         public function __construct($id, $complete = true){
             global $db;
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  family, " .
-              "  name, " .
-              "  element, " .
-              "  archetype, " .
-              "  base_stars, " .
-              "  natural_stars, " .
-              "  obtainable, " .
-              "  can_awaken, " .
-              "  awaken_bonus, " .
-              "  skill_ups_to_max, " .
-              "  leader_skill, " .
-              "  hp, " .
-              "  attack, " .
-              "  defense, " .
-              "  speed, " .
-              "  crit_rate, " .
-              "  crit_damage, " .
-              "  resistance, " .
-              "  accuracy, " .
-              "  raw_hp, " .
-              "  raw_attack, " .
-              "  raw_defense, " .
-              "  max_lvl_hp, " .
-              "  max_lvl_attack, " .
-              "  max_lvl_defense, " .
-              "  awakens_from, " .
-              "  awakens_to, " .
-              "  fusion_food, " .
-              "  homunculus, " .
-              "  craft_cost " .
-              "FROM k_unit " .
-              "WHERE id = $id; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
             $this->id = $id;
+            $statement = $db->prepare("
+              SELECT
+                id,
+                family,
+                name,
+                element,
+                archetype,
+                base_stars,
+                natural_stars,
+                obtainable,
+                can_awaken,
+                awaken_bonus,
+                skill_ups_to_max,
+                leader_skill,
+                hp,
+                attack,
+                defense,
+                speed,
+                crit_rate,
+                crit_damage,
+                resistance,
+                accuracy,
+                raw_hp,
+                raw_attack,
+                raw_defense,
+                max_lvl_hp,
+                max_lvl_attack,
+                max_lvl_defense,
+                awakens_from,
+                awakens_to,
+                fusion_food,
+                homunculus,
+                craft_cost
+              FROM k_unit
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->family = $r["family"];
                 $this->name = HTML::e($r["name"]);
@@ -390,15 +391,17 @@
         public function load_essences(){
             global $db;
             $this->essences = [];
-            $s =
-              "SELECT " .
-              "  item, " .
-              "  amount " .
-              "FROM k_unit_essence " .
-              "WHERE " .
-              "  unit = " . $this->id . " " .
-              "ORDER BY item; ";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT
+                item,
+                amount
+              FROM k_unit_essence
+              WHERE
+                unit = :unit
+              ORDER BY item;
+            ");
+            $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 $e = [
                     "item" => new K_Inventory($r["item"], INVENTORY_TYPE_ID::ESSENCES),
@@ -420,12 +423,13 @@
         public function load_transformation(){
             global $db;
             $this->transformation = null;
-            $s = "
+            $statement = $db->prepare("
               SELECT id
               FROM k_unit_transformation
-              WHERE  unit = " . $this->id . ";";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+              WHERE  unit = :unit;
+            ");
+            $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->transformation = new K_Unit_Transformation($r["id"]);
             }
@@ -443,17 +447,18 @@
         public function load_skills(){
             global $db;
             $this->skill = [];
-            $s = "
+            $statement = $db->prepare("
               SELECT skill
               FROM
                 k_skill,
                 k_unit_skill
               WHERE
                 id = skill AND
-                unit = " . $this->id . "
+                unit = :unit
               ORDER BY slot;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->skill, new K_Skill($r["skill"]));
             }
@@ -471,11 +476,13 @@
         public function load_sources(){
             global $db;
             $this->sources = [];
-            $s =
-              "SELECT source " .
-              "FROM k_unit_source " .
-              "WHERE unit = " . $this->id . ";";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT source
+              FROM k_unit_source
+              WHERE unit = :unit;
+            ");
+            $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->sources, new K_Source($r["source"]));
             }

application/entity/K_Unit_Transformation.php

@@ -41,7 +41,7 @@
         public $unit;
 
         /**
-         * @var \K_Monster_Skill[] Skills in the transformed form.
+         * @var \K_Skill[] Skills in the transformed form.
          */
         public $skill = [];
 
@@ -56,16 +56,16 @@
          */
         public function __construct($id){
             global $db;
-            $s = "
+            $statement = $db->prepare("
               SELECT
                 id,
                 family,
                 unit
               FROM k_unit_transformation
-              WHERE id = $id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+               WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->family = $r["family"];

application/entity/Player.php

@@ -185,7 +185,7 @@
         public function __construct($id, $complete = true){
             global $UID;
             global $db;
-            $s = "
+            $statement = $db->prepare("
               SELECT
                 uid,
                 name,
@@ -220,10 +220,10 @@
                 top_rank_toan,
                 top_rank_toah
               FROM player
-              WHERE uid = '$UID';
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+              WHERE uid = :uid;
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->uid = $r["uid"];
                 $this->name = $r["name"];
@@ -260,25 +260,27 @@
                 $this->top_rank_toan = $r["top_rank_toan"];
                 $this->top_rank_toah = $r["top_rank_toah"];
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT unit
                 FROM defense
-                WHERE uid = '$UID'
+                WHERE uid = :uid
                 ORDER BY position;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->defense, new Unit($r["unit"], false));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   unit,
                   position
                 FROM gw_defense
-                WHERE uid = '$UID'
+                WHERE uid = :uid
                 ORDER BY position;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 if ($r["position"] <= 3){
                     array_push($this->gw_defense[0], new Unit($r["unit"], false));
@@ -287,7 +289,7 @@
                     array_push($this->gw_defense[1], new Unit($r["unit"], false));
                 }
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   building.id,
                   min(building)
@@ -295,72 +297,80 @@
                   building,
                   k_building
                 WHERE
-                  uid = '$UID' AND
+                  uid = :uid AND
                   building.building = k_building.id 
                 GROUP BY building.building;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->building, new Building($r["id"]));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT id
                 FROM decoration
-                WHERE uid = '$UID';
-            ";
-            $q = $db->query($s);
+                WHERE uid = :uid;
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->decoration, new Decoration($r["id"]));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   id,
                   type
                 FROM inventory
                 WHERE
-                  uid = '$UID' AND
-                  type = " . INVENTORY_TYPE_ID::SCROLL . " AND
+                  uid = :uid AND
+                  type = :type AND
                   amount > 0
                 ORDER BY inventory.type;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':type', INVENTORY_TYPE_ID::SCROLL, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->inventory_scroll, new Inventory($r["id"], $r["type"]));
             }
             // Rune crafting items are marked as generic crafting.
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   inventory.id AS id,
                   inventory.type AS type
                 FROM
                   inventory
                 WHERE
-                  inventory.uid = '$UID' AND
-                  inventory.type = " . INVENTORY_TYPE_ID::ENCHANTMENT . " AND
+                  inventory.uid = :uid AND
+                  inventory.type = :type AND
                   amount > 0
                 ORDER BY inventory.id;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':type', INVENTORY_TYPE_ID::ENCHANTMENT, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->inventory_craft_rune, new Inventory($r["id"], $r["type"]));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   inventory.id AS id,
                   inventory.type AS type
                 FROM
                   inventory
                 WHERE
-                  inventory.uid = '$UID' AND
-                  inventory.type = " . INVENTORY_TYPE_ID::CRAFT_STUFF . " AND
+                  inventory.uid = :uid AND
+                  inventory.type = :type AND
                   amount > 0
                 ORDER BY inventory.id;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':type', INVENTORY_TYPE_ID::CRAFT_STUFF, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->inventory_craft, new Inventory($r["id"], $r["type"]));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   inventory.id AS id,
                   inventory.type AS type
@@ -370,8 +380,8 @@
                 WHERE
                   inventory.id = k_inventory.id AND
                   inventory.type = k_inventory.type AND
-                  inventory.uid = '$UID' AND
-                  inventory.type = " . INVENTORY_TYPE_ID::ESSENCES . " AND
+                  inventory.uid = :uid AND
+                  inventory.type = :type AND
                   amount > 0
                 ORDER BY
                   upper(name) NOT LIKE '%MAGIC%',
@@ -384,21 +394,22 @@
                   upper(name) NOT LIKE '%MID%',
                   upper(name) NOT LIKE '%HIGH%'
                 ;
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':type', INVENTORY_TYPE_ID::ESSENCES, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->inventory_essence, new Inventory($r["id"], $r["type"]));
             }
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   uid,
                   area_type,
                   area
                 FROM record
-                WHERE uid = '$UID'
+                WHERE uid = :uid
                 ORDER BY
                   CASE
-
                     WHEN (area_type = 2 AND area = 8001) THEN  1 -- Giant's Keep
                     WHEN (area_type = 2 AND area = 9001) THEN  2 -- Dragon's Lair
                     WHEN (area_type = 2 AND area = 6001) THEN  3 -- Necropolis
@@ -418,8 +429,9 @@
                     WHEN (area_type = 2 AND area = 1001) THEN 17 -- Hall of Dark
                     ELSE area 
                     END ASC
-            ";
-            $q = $db->query($s);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->record, new Record($r["uid"], $r["area_type"], $r["area"]));
             }

application/entity/Record.php

@@ -85,7 +85,7 @@
 
             global $db;
 
-            $s = "
+            $statement = $db->prepare("
                 SELECT
                   uid,
                   area_type,
@@ -96,47 +96,54 @@
                   rank
                 FROM record
                 WHERE
-                  uid = $uid AND
-                  area_type = $area_type AND
-                  area = $area;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->uid = $r["uid"];
-            $this->area = new K_Area($r["area"], $r["area_type"]);
-            $this->stage = $r["stage"];
-            $this->time = $r["time"];
-            $this->score = $r["score"];
-            $this->rank = $r["rank"];
-            $s = "
-                SELECT
-                  unit,
-                  k_unit,
-                  (SELECT count(id) FROM unit WHERE unit.id = record_party.unit) AS owned,
-                  leader,
-                  front
-                FROM record_party
-                WHERE
-                  uid = $uid AND
-                  area_type = $area_type AND
-                  area = $area
-                ORDER BY 
-                  front DESC,
-                  leader DESC;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                if ($r["owned"] > 0){
-                    array_push($this->party, new Unit($r["unit"], false));
-                }
-                else{
-                    array_push($this->party, new K_Unit($r["k_unit"], false));
-                }
-                if ($r["leader"] == 1){
-                    $this->leader = $r["unit"];
-                }
-                if ($r["front"] == 1){
-                    array_push($this->frontline, $r["unit"]);
+                  uid = :uid AND
+                  area_type = :area_type AND
+                  area = :area;
+            ");
+            $statement->bindValue(':uid', $uid, SQLITE3_INTEGER);
+            $statement->bindValue(':area_type', $area_type, SQLITE3_INTEGER);
+            $statement->bindValue(':area', $area, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->uid = $r["uid"];
+                $this->area = new K_Area($r["area"], $r["area_type"]);
+                $this->stage = $r["stage"];
+                $this->time = $r["time"];
+                $this->score = $r["score"];
+                $this->rank = $r["rank"];
+                $statement = $db->prepare("
+                    SELECT
+                      unit,
+                      k_unit,
+                      (SELECT count(id) FROM unit WHERE unit.id = record_party.unit) AS owned,
+                      leader,
+                      front
+                    FROM record_party
+                    WHERE
+                      uid = :uid AND
+                      area_type = :area_type AND
+                      area = :area
+                    ORDER BY 
+                      front DESC,
+                      leader DESC;
+                ");
+                $statement->bindValue(':uid', $uid, SQLITE3_INTEGER);
+                $statement->bindValue(':area_type', $area_type, SQLITE3_INTEGER);
+                $statement->bindValue(':area', $area, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    if ($r["owned"] > 0){
+                        array_push($this->party, new Unit($r["unit"], false));
+                    }
+                    else{
+                        array_push($this->party, new K_Unit($r["k_unit"], false));
+                    }
+                    if ($r["leader"] == 1){
+                        $this->leader = $r["unit"];
+                    }
+                    if ($r["front"] == 1){
+                        array_push($this->frontline, $r["unit"]);
+                    }
                 }
             }
         }

application/entity/Run.php

@@ -177,250 +177,259 @@
 
             global $db;
 
-            $s = "
-                SELECT
-                  id,
-                  uid,
-                  dtime,
-                  area_type,
-                  area,
-                  stage,
-                  difficulty,
-                  win,
-                  time,
-                  mana,
-                  energy,
-                  crystal,
-                  honor_points,
-                  guild_points,
-                  helper,
-                  score,
-                  rank
-                FROM run
-                WHERE id = $id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->id = $r["id"];
-            $this->uid = $r["uid"];
-            $this->dtime = $r["dtime"];
-            $this->area = new K_Area($r["area"], $r["area_type"]);
-            $this->stage = $r["stage"];
-            $this->difficulty = $r["difficulty"];
-            $this->win = $r["win"];
-            $this->time = $r["time"];
-            $this->mana = $r["mana"];
-            $this->energy = $r["energy"];
-            $this->crystal = $r["crystal"];
-            $this->honor_points = $r["honor_points"];
-            $this->guild_points = $r["guild_points"];
-            $this->helper = $r["helper"];
-            $this->score = $r["score"];
-            $this->rank = $r["rank"];
-            $s = "
-                SELECT
-                  unit,
-                  k_unit,
-                  (SELECT count(id) FROM unit WHERE unit.id = run_party.unit) AS owned,
-                  leader,
-                  front
-                FROM run_party
-                WHERE run = $id
-                ORDER BY 
-                  front DESC,
-                  leader DESC;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                if ($r["owned"] > 0){
-                    array_push($this->party, new Unit($r["unit"], false));
+            $statement = $db->prepare("
+              SELECT
+                id,
+                uid,
+                dtime,
+                area_type,
+                area,
+                stage,
+                difficulty,
+                win,
+                time,
+                mana,
+                energy,
+                crystal,
+                honor_points,
+                guild_points,
+                helper,
+                score,
+                rank
+              FROM run
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->id = $r["id"];
+                $this->uid = $r["uid"];
+                $this->dtime = $r["dtime"];
+                $this->area = new K_Area($r["area"], $r["area_type"]);
+                $this->stage = $r["stage"];
+                $this->difficulty = $r["difficulty"];
+                $this->win = $r["win"];
+                $this->time = $r["time"];
+                $this->mana = $r["mana"];
+                $this->energy = $r["energy"];
+                $this->crystal = $r["crystal"];
+                $this->honor_points = $r["honor_points"];
+                $this->guild_points = $r["guild_points"];
+                $this->helper = $r["helper"];
+                $this->score = $r["score"];
+                $this->rank = $r["rank"];
+                $statement = $db->prepare("
+                    SELECT
+                      unit,
+                      k_unit,
+                      (SELECT count(id) FROM unit WHERE unit.id = run_party.unit) AS owned,
+                      leader,
+                      front
+                    FROM run_party
+                    WHERE run = :run
+                    ORDER BY 
+                      front DESC,
+                      leader DESC;
+                ");
+                $statement->bindValue(':run', $id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    if ($r["owned"] > 0){
+                        array_push($this->party, new Unit($r["unit"], false));
+                    }
+                    else{
+                        array_push($this->party, new K_Unit($r["k_unit"], false));
+                    }
+                    if ($r["leader"] == 1){
+                        $this->leader = $r["unit"];
+                    }
+                    if ($r["front"] == 1){
+                        array_push($this->frontline, $r["unit"]);
+                    }
                 }
-                else{
-                    array_push($this->party, new K_Unit($r["k_unit"], false));
+                $statement = $db->prepare("
+                    SELECT
+                      item,
+                      amount
+                    FROM run_drop_item
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    $i = new Inventory($r["item"]);
+                    $i->amount =  $r["amount"];
+                    array_push($this->item, $i);
                 }
-                if ($r["leader"] == 1){
-                    $this->leader = $r["unit"];
+                $statement = $db->prepare("
+                    SELECT unit
+                    FROM run_drop_unit
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    array_push($this->unit, new K_Unit($r["unit"]));
                 }
-                if ($r["front"] == 1){
-                    array_push($this->frontline, $r["unit"]);
+                $statement = $db->prepare("
+                    SELECT unit
+                    FROM run_drop_sd
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    array_push($this->sd, new K_Unit($r["unit"]));
                 }
-            }
-            $s = "
-                SELECT
-                  item,
-                  amount
-                FROM run_drop_item
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                $i = new Inventory($r["item"]);
-                $i->amount =  $r["amount"];
-                array_push($this->item, $i);
-            }
-            $s = "
-                SELECT unit
-                FROM run_drop_unit
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($this->unit, new K_Unit($r["unit"]));
-            }
-            $s = "
-                SELECT unit
-                FROM run_drop_sd
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                array_push($this->sd, new K_Unit($r["unit"]));
-            }
-            $s = "
-                SELECT
-                  unit,
-                  amount
-                FROM run_drop_unit_pieces
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                $i = [
-                    "unit" => new K_Unit($r["unit"]),
-                    "amount" => $r["amount"]
-                ];
-                array_push($this->unit_piece, $i);
-            }
-            $s = "
-                SELECT amount
-                FROM run_drop_shapeshifting
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            if ($r){
-                $this->shapeshifting = $r["amount"];
-            }
-            $s = "
-                SELECT
-                  id,
-                  type,
-                  slot,
-                  stars,
-                  ancient,
-                  quality,
-                  value,
-                  efficiency,
-                  main_stat,
-                  main_stat_value,
-                  innate_stat,
-                  innate_stat_value,
-                  substat_1,
-                  substat_1_value,
-                  substat_2,
-                  substat_2_value,
-                  substat_3,
-                  substat_3_value,
-                  substat_4,
-                  substat_4_value
-                FROM run_drop_rune
-                WHERE run = $this->id;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                $rune = new Rune($r["id"]);
-                if (!isset($rune->id)){
-                    $rune->id = $r["id"];
-                    $rune->level = 0;
-                    $rune->assigned_to = null;
-                    $rune->type = new K_Rune_Set($r["type"]);
-                    $rune->slot = $r["slot"];
-                    $rune->stars = $r["stars"];
-                    $rune->ancient = $r["ancient"];
-                    $rune->quality = $r["quality"];
-                    $rune->original_quality = $r["quality"];
-                    $rune->value = $r["value"];
-                    $rune->value = 0;
-                    $rune->efficiency = $r["efficiency"];
-                    // TODO: Calculate?
-                    $rune->max_efficiency = $r["efficiency"];
-                    $rune->main_stat = $r["main_stat"];
-                    $rune->main_stat_value = $r["main_stat_value"];
-                    $rune->innate_stat = $r["innate_stat"];
-                    $rune->innate_stat_value = $r["innate_stat_value"];
-                    $rune->substat_1 = $r["substat_1"];
-                    $rune->substat_1_value = $r["substat_1_value"];
-                    $rune->substat_1_enchant = 0;
-                    $rune->substat_1_grind = 0;
-                    $rune->substat_2 = $r["substat_2"];
-                    $rune->substat_2_value = $r["substat_2_value"];
-                    $rune->substat_2_enchant = 0;
-                    $rune->substat_2_grind = 0;
-                    $rune->substat_3 = $r["substat_3"];
-                    $rune->substat_3_value = $r["substat_3_value"];
-                    $rune->substat_3_enchant = 0;
-                    $rune->substat_3_grind = 0;
-                    $rune->substat_4 = $r["substat_4"];
-                    $rune->substat_4_value = $r["substat_4_value"];
-                    $rune->substat_4_enchant = 0;
-                    $rune->substat_4_grind = 0;
-                    $rune->refresh_names();
+                $statement = $db->prepare("
+                    SELECT
+                      unit,
+                      amount
+                    FROM run_drop_unit_pieces
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    $i = [
+                        "unit" => new K_Unit($r["unit"]),
+                        "amount" => $r["amount"]
+                    ];
+                    array_push($this->unit_piece, $i);
                 }
-                array_push($this->rune, $rune);
-            }
-            $s = "
-              SELECT
-                run_drop_enchantment.id AS id,
-                type,
-                run_drop_enchantment.quality AS quality,
-                rune,
-                run_drop_enchantment.stat AS stat,
-                value,
-                k_enchantment_type.inmemorial AS inmemorial,
-                k_enchantment_type.ancient AS ancient,
-                k_enchantment_range.min AS min,
-                k_enchantment_range.max AS max
-              FROM
-                run_drop_enchantment,
-                k_enchantment_type,
-                k_enchantment_range
-              WHERE
-                run = $this->id AND
-                run_drop_enchantment.type = k_enchantment_type.id AND
-                k_enchantment_type.gem = k_enchantment_range.gem AND
-                k_enchantment_type.gem = k_enchantment_range.gem AND
-                k_enchantment_type.ancient = k_enchantment_range.ancient AND
-                run_drop_enchantment.quality = k_enchantment_range.quality AND
-                run_drop_enchantment.stat = k_enchantment_range.stat;
-              ;
-            ";
-            $q = $db->query($s);
-            while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                $enchantment = new Enchantment($r["id"]);
-                if (!isset($enchantment->id)){
-                    $enchantment->id = $r["id"];
-                    if ($r["type"] == CRAFT_ID::ENCHANT_GEM || $r["type"] == CRAFT_ID::IMMEMORIAL_GEM){
-                        $enchantment->gem = 1;
+                $statement = $db->prepare("
+                    SELECT amount
+                    FROM run_drop_shapeshifting
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                $r = $q->fetchArray(SQLITE3_ASSOC);
+                if ($r){
+                    $this->shapeshifting = $r["amount"];
+                }
+                $statement = $db->prepare("
+                    SELECT
+                      id,
+                      type,
+                      slot,
+                      stars,
+                      ancient,
+                      quality,
+                      value,
+                      efficiency,
+                      main_stat,
+                      main_stat_value,
+                      innate_stat,
+                      innate_stat_value,
+                      substat_1,
+                      substat_1_value,
+                      substat_2,
+                      substat_2_value,
+                      substat_3,
+                      substat_3_value,
+                      substat_4,
+                      substat_4_value
+                    FROM run_drop_rune
+                    WHERE run = :run;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    $rune = new Rune($r["id"]);
+                    if (!isset($rune->id)){
+                        $rune->id = $r["id"];
+                        $rune->level = 0;
+                        $rune->assigned_to = null;
+                        $rune->type = new K_Rune_Set($r["type"]);
+                        $rune->slot = $r["slot"];
+                        $rune->stars = $r["stars"];
+                        $rune->ancient = $r["ancient"];
+                        $rune->quality = $r["quality"];
+                        $rune->original_quality = $r["quality"];
+                        $rune->value = $r["value"];
+                        $rune->value = 0;
+                        $rune->efficiency = $r["efficiency"];
+                        // TODO: Calculate?
+                        $rune->max_efficiency = $r["efficiency"];
+                        $rune->main_stat = $r["main_stat"];
+                        $rune->main_stat_value = $r["main_stat_value"];
+                        $rune->innate_stat = $r["innate_stat"];
+                        $rune->innate_stat_value = $r["innate_stat_value"];
+                        $rune->substat_1 = $r["substat_1"];
+                        $rune->substat_1_value = $r["substat_1_value"];
+                        $rune->substat_1_enchant = 0;
+                        $rune->substat_1_grind = 0;
+                        $rune->substat_2 = $r["substat_2"];
+                        $rune->substat_2_value = $r["substat_2_value"];
+                        $rune->substat_2_enchant = 0;
+                        $rune->substat_2_grind = 0;
+                        $rune->substat_3 = $r["substat_3"];
+                        $rune->substat_3_value = $r["substat_3_value"];
+                        $rune->substat_3_enchant = 0;
+                        $rune->substat_3_grind = 0;
+                        $rune->substat_4 = $r["substat_4"];
+                        $rune->substat_4_value = $r["substat_4_value"];
+                        $rune->substat_4_enchant = 0;
+                        $rune->substat_4_grind = 0;
+                        $rune->refresh_names();
+                    }
+                    array_push($this->rune, $rune);
+                }
+                $statement = $db->prepare("
+                  SELECT
+                    run_drop_enchantment.id AS id,
+                    type,
+                    run_drop_enchantment.quality AS quality,
+                    rune,
+                    run_drop_enchantment.stat AS stat,
+                    value,
+                    k_enchantment_type.inmemorial AS inmemorial,
+                    k_enchantment_type.ancient AS ancient,
+                    k_enchantment_range.min AS min,
+                    k_enchantment_range.max AS max
+                  FROM
+                    run_drop_enchantment,
+                    k_enchantment_type,
+                    k_enchantment_range
+                  WHERE
+                    run = :run AND
+                    run_drop_enchantment.type = k_enchantment_type.id AND
+                    k_enchantment_type.gem = k_enchantment_range.gem AND
+                    k_enchantment_type.gem = k_enchantment_range.gem AND
+                    k_enchantment_type.ancient = k_enchantment_range.ancient AND
+                    run_drop_enchantment.quality = k_enchantment_range.quality AND
+                    run_drop_enchantment.stat = k_enchantment_range.stat;
+                ");
+                $statement->bindValue(':run', $this->id, SQLITE3_INTEGER);
+                $q = $statement->execute();
+                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                    $enchantment = new Enchantment($r["id"]);
+                    if (!isset($enchantment->id)){
+                        $enchantment->id = $r["id"];
+                        if ($r["type"] == CRAFT_ID::ENCHANT_GEM || $r["type"] == CRAFT_ID::IMMEMORIAL_GEM){
+                                $enchantment->gem = 1;
+                        }
+                        else{
+                                $enchantment->gem = 0;
+                        }
+                        $enchantment->quality = $r["quality"];
+                        $enchantment->value = 0;
+                        $enchantment->stat = $r["stat"];
+                        $enchantment->ancient = $r["ancient"];
+                        $enchantment->inmemorial = $r["inmemorial"];
+                        $enchantment->rune = new K_Rune_Set($r["rune"]);
+                        $enchantment->min = $r["min"];
+                        $enchantment->max = $r["max"];
+                        $enchantment->value = $r["value"];
+                        $enchantment->amount = 0;
+                        $enchantment->refresh_names();
                     }
                     else{
-                        $enchantment->gem = 0;
+                        $enchantment->amount = 0;
                     }
-                    $enchantment->quality = $r["quality"];
-                    $enchantment->value = 0;
-                    $enchantment->stat = $r["stat"];
-                    $enchantment->ancient = $r["ancient"];
-                    $enchantment->inmemorial = $r["inmemorial"];
-                    $enchantment->rune = new K_Rune_Set($r["rune"]);
-                    $enchantment->min = $r["min"];
-                    $enchantment->max = $r["max"];
-                    $enchantment->value = $r["value"];
-                    $enchantment->amount = 0;
-                    $enchantment->refresh_names();
-                }
-                else{
-                    $enchantment->amount = 0;
+                    array_push($this->enchantment, $enchantment);
                 }
-                array_push($this->enchantment, $enchantment);
             }
         }
 

application/entity/Rune.php

@@ -65,14 +65,14 @@
         /**
          * @var int Rune quality.
          *
-         * @see QUALITY
+         * @see QUALITY_ID
          */
         public $quality;
 
         /**
          * @var int Rune original quality.
          *
-         * @see QUALITY
+         * @see QUALITY_ID
          */
         public $original_quality;
 
@@ -104,7 +104,7 @@
         /**
          * @var int Main stat of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $main_stat;
 
@@ -121,7 +121,7 @@
         /**
          * @var int Extra stat of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $innate_stat;
 
@@ -143,7 +143,7 @@
         /**
          * @var int Substat 1 of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $substat_1;
 
@@ -165,7 +165,7 @@
         /**
          * @var int Substat 2 of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $substat_2;
 
@@ -187,7 +187,7 @@
         /**
          * @var int Substat 3 of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $substat_3;
 
@@ -209,7 +209,7 @@
         /**
          * @var int Substat 4 of the rune.
          *
-         * @see RUNE_STAT
+         * @see RUNE_STAT_ID
          */
         public $substat_4;
 
@@ -241,44 +241,45 @@
 
             global $db;
 
-            $s =
-              "SELECT " .
-              "  id, " .
-              "  assigned_to, " .
-              "  type, " .
-              "  slot, " .
-              "  stars, " .
-              "  level, " .
-              "  ancient, " .
-              "  quality, " .
-              "  original_quality, " .
-              "  value, " .
-              "  efficiency, " .
-              "  max_efficiency, " .
-              "  main_stat, " .
-              "  main_stat_value, " .
-              "  innate_stat, " .
-              "  innate_stat_value, " .
-              "  substat_1, " .
-              "  substat_1_value, " .
-              "  substat_1_enchant, " .
-              "  substat_1_grind, " .
-              "  substat_2, " .
-              "  substat_2_value, " .
-              "  substat_2_enchant, " .
-              "  substat_2_grind, " .
-              "  substat_3, " .
-              "  substat_3_value, " .
-              "  substat_3_enchant, " .
-              "  substat_3_grind, " .
-              "  substat_4, " .
-              "  substat_4_value, " .
-              "  substat_4_enchant, " .
-              "  substat_4_grind " .
-              "FROM rune " .
-              "WHERE id = '$id'; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+            $statement = $db->prepare("
+              SELECT
+                id,
+                assigned_to,
+                type,
+                slot,
+                stars,
+                level,
+                ancient,
+                quality,
+                original_quality,
+                value,
+                efficiency,
+                max_efficiency,
+                main_stat,
+                main_stat_value,
+                innate_stat,
+                innate_stat_value,
+                substat_1,
+                substat_1_value,
+                substat_1_enchant,
+                substat_1_grind,
+                substat_2,
+                substat_2_value,
+                substat_2_enchant,
+                substat_2_grind,
+                substat_3,
+                substat_3_value,
+                substat_3_enchant,
+                substat_3_grind,
+                substat_4,
+                substat_4_value,
+                substat_4_enchant,
+                substat_4_grind
+              FROM rune
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
                 $this->assigned_to = $r["assigned_to"];

application/entity/Team.php

@@ -58,7 +58,7 @@
         public $frontline = [];
 
         /**
-         * @var Area Area the team is designed for.
+         * @var \K_Area Area the team is designed for.
          */
         public $area;
 
@@ -93,7 +93,7 @@
 
             global $db;
 
-            $s = "
+            $statement = $db->prepare("
               SELECT
                 uid,
                 id,
@@ -105,37 +105,40 @@
                 difficulty,
                 score
               FROM team
-              WHERE id = '$id';
-            ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
-            $this->uid = $r["uid"];
-            $this->id = $r["id"];
-            $this->name = HTML::e($r["name"]);
-            $this->description = HTML::e($r["description"]);
-            $this->area = new K_Area($r["area"], $r["area_type"]);
-            $this->stage = $r["stage"];
-            $this->score = $r["score"];
-            if ($complete){
-                $s = "
-                  SELECT
-                    unit,
-                    leader,
-                    front
-                  FROM team_unit
-                  WHERE team = '$id'
-                  ORDER BY 
-                    front DESC,
-                    leader DESC;
-                ";
-                $q = $db->query($s);
-                while ($r = $q->fetchArray(SQLITE3_ASSOC)){
-                    array_push($this->unit, new Unit($r["unit"], false));
-                    if ($r["leader"] == 1){
-                        $this->leader = $r["unit"];
-                    }
-                    if ($r["front"] == 1){
-                        array_push($this->frontline, $r["unit"]);
+              WHERE id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->uid = $r["uid"];
+                $this->id = $r["id"];
+                $this->name = HTML::e($r["name"]);
+                $this->description = HTML::e($r["description"]);
+                $this->area = new K_Area($r["area"], $r["area_type"]);
+                $this->stage = $r["stage"];
+                $this->score = $r["score"];
+                if ($complete){
+                    $statement = $db->prepare("
+                      SELECT
+                        unit,
+                        leader,
+                        front
+                      FROM team_unit
+                      WHERE team = :team
+                      ORDER BY 
+                        front DESC,
+                        leader DESC;
+                    ");
+                    $statement->bindValue(':team', $this->id, SQLITE3_INTEGER);
+                    $q = $statement->execute();
+                    while ($r = $q->fetchArray(SQLITE3_ASSOC)){
+                        array_push($this->unit, new Unit($r["unit"], false));
+                        if ($r["leader"] == 1){
+                            $this->leader = $r["unit"];
+                        }
+                        if ($r["front"] == 1){
+                            array_push($this->frontline, $r["unit"]);
+                        }
                     }
                 }
             }

application/entity/Unit.php

@@ -377,36 +377,38 @@
             if ($uid == 0){
                 $uid = $UID;
             }
-            $s =
-              "SELECT " .
-              "  uid, " .
-              "  id, " .
-              "  building, " .
-              "  unit, " .
-              "  stars, " .
-              "  level, " .
-              "  hp, " .
-              "  attack, " .
-              "  defense, " .
-              "  speed, " .
-              "  crit_rate, " .
-              "  crit_damage, " .
-              "  resistance, " .
-              "  accuracy, " .
-              "  experience, " .
-              "  exp_gained, " .
-              "  exp_gain_rate, " .
-              "  costume, " .
-              "  source, " .
-              "  create_time, " .
-              "  homunculus_name, " .
-              "  lock " .
-              "FROM unit " .
-              "WHERE " .
-              "  uid = '$uid' AND " .
-              "  id = '$id'; ";
-            $q = $db->query($s);
-            $r = $q->fetchArray(SQLITE3_ASSOC);
+             $statement = $db->prepare("
+              SELECT
+                uid,
+                id,
+                building,
+                unit,
+                stars,
+                level,
+                hp,
+                attack,
+                defense,
+                speed,
+                crit_rate,
+                crit_damage,
+                resistance,
+                accuracy,
+                experience,
+                exp_gained,
+                exp_gain_rate,
+                costume,
+                source,
+                create_time,
+                homunculus_name,
+                lock
+              FROM unit
+              WHERE
+                uid = :uid AND
+                id = :id;
+            ");
+            $statement->bindValue(':id', $id, SQLITE3_INTEGER);
+            $statement->bindValue(':uid', $uid, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->uid = $r["uid"];
                 $this->id = $r["id"];
@@ -438,29 +440,35 @@
                     $this->load_teams();
                     $this->check_storage();
                     $this->lock = $r["lock"];
-                    $s =
-                      "SELECT level " .
-                      "FROM " .
-                      "  unit_skill, " .
-                      "  k_skill " .
-                      "WHERE " .
-                      "  k_skill.id = unit_skill.skill AND " .
-                      "  unit = '$this->id' " .
-                      "ORDER BY slot;";
-                    $q = $db->query($s);
+                    $statement = $db->prepare("
+                      SELECT level
+                      FROM
+                        unit_skill,
+                        k_skill
+                      WHERE
+                        k_skill.id = unit_skill.skill AND
+                        unit = :unit
+                      ORDER BY slot;
+                    ");
+                    $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+                    $q = $statement->execute();
                     while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                         array_push($this->skill_levels, $r["level"]);
                     }
-                    $s =
-                      "SELECT exp " .
-                      "FROM k_experience " .
-                      "WHERE " .
-                      "  stars = $this->stars AND " .
-                      "  level = $this->level;";
-                    $q = $db->query($s);
-                    $r = $q->fetchArray(SQLITE3_ASSOC);
-                    $this->experience_level = $r["exp"];
-                    $this->experience_level_up = $r["exp"] - $this->exp_gained;
+                    $statement = $db->prepare("
+                      SELECT exp
+                      FROM k_experience
+                      WHERE
+                        stars = :stars AND
+                        level = :level;
+                    ");
+                    $statement->bindValue(':stars', $this->stars, SQLITE3_INTEGER);
+                    $statement->bindValue(':level', $this->level, SQLITE3_INTEGER);
+                    $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+                    if ($r){
+                        $this->experience_level = $r["exp"];
+                        $this->experience_level_up = $r["exp"] - $this->exp_gained;
+                    }
                 }
                 if ($this->unit->homunculus){
                     $this->title = $this->homunculus_name;
@@ -481,24 +489,27 @@
         public function check_storage(){
             global $UID;
             global $db;
-            $s = "
+            $statement = $db->prepare("
               SELECT 1
               FROM
                 unit,
                 building
               WHERE
-                unit.id = $this->id AND
-                unit.uid = '$UID' AND
-                building.uid = '$UID' AND
+                unit.id = :id AND
+                unit.uid = :uid AND
+                building.uid = :uid AND
                 unit.building = building.id AND
-                building.building = '" . BUILDING_ID::MONSTER_STORAGE . "';
-            ";
-            $q = $db->query($s);
-            if ($q->fetchArray(SQLITE3_ASSOC) == false){
-                $this->in_storage = false;
+                building.building = :building;
+            ");
+            $statement->bindValue(':id', $this->id, SQLITE3_INTEGER);
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':building', BUILDING_ID::MONSTER_STORAGE, SQLITE3_INTEGER);
+            $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
+            if ($r){
+                $this->in_storage = true;
             }
             else{
-                $this->in_storage = true;
+                $this->in_storage = false;
             }
         }
 
@@ -517,11 +528,13 @@
 
             // Runes
             $this->rune = [];
-            $s =
-              "SELECT id " .
-              "FROM rune " .
-              "WHERE assigned_to = '$this->id'; ";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT id
+              FROM rune
+              WHERE assigned_to = :assigned;
+            ");
+            $statement->bindValue(':assigned', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->rune, new Rune($r["id"]));
             }
@@ -538,11 +551,13 @@
             $this->rune_hp = ceil($this->rune_hp);
 
             // Artifacts
-            $s =
-              "SELECT id " .
-              "FROM artifact " .
-              "WHERE assigned_to = '$this->id'; ";
-            $q = $db->query($s);
+            $statement = $db->prepare("
+              SELECT id
+              FROM artifact
+              WHERE assigned_to = :assigned;
+            ");
+            $statement->bindValue(':assigned', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 $artifact = new Artifact($r["id"]);
                 if ($artifact->type == ARTIFACT_TYPE::ARCHETYPE){
@@ -565,7 +580,7 @@
             }
 
             // Buildings
-            $s = "
+            $statement = $db->prepare("
               SELECT
                 affected_stat,
                 bonus,
@@ -575,14 +590,21 @@
                 k_decoration_level,
                 decoration
               WHERE
-                decoration.uid = '$UID' AND
+                decoration.uid = :uid AND
                 k_decoration.id = decoration.decoration AND
                 decoration.decoration = k_decoration_level.decoration AND
                 decoration.level = k_decoration_level.level AND
-                area = " . EFFECT_AREA_ID::GENERAL . " AND
-                affected_stat IN (" . STAT_ID::ATK . ", " . STAT_ID::DEF . ", " . STAT_ID::HP . ", " . STAT_ID::SPD . ", " . STAT_ID::CRIT_DMG . ");
-            ";
-            $q = $db->query($s);
+                area = :area AND
+                affected_stat IN (:stat_atk, :stat_def, :stat_hp, :stat_spd, :stat_crd);
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':area', EFFECT_AREA_ID::GENERAL, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_atk', STAT_ID::ATK, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_def', STAT_ID::DEF, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_hp', STAT_ID::HP, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_spd', STAT_ID::SPD, SQLITE3_INTEGER);
+            $statement->bindValue(':stat_crd', STAT_ID::CRIT_DMG, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 switch($r["affected_stat"]){
                     case STAT_ID::DEF:
@@ -655,17 +677,19 @@
             global $UID;
             global $db;
             $this->teams = [];
-            $s = "
+            $statement = $db->prepare("
               SELECT DISTINCT team.id AS id
               FROM
                 team,
                 team_unit
               WHERE
-                team.uid = '$UID' AND
+                team.uid = :uid AND
                 team.id = team_unit.team AND
-                team_unit.unit = '" . $this->id . "';
-            ";
-            $q = $db->query($s);
+                team_unit.unit = :unit;
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $statement->bindValue(':unit', $this->id, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->teams, new Team($r["id"], false));
             }

application/helper/APPLICATION_Helper.php

@@ -59,7 +59,7 @@
          *   BUILDING
          * @param string|int $name Filename, with no path or extension. It can also
          * skip the padding. An id can be used.
-         * @return Image URL if found. If not, the URL to an 'unknown' icon.
+         * @return string URL if found. If not, the URL to an 'unknown' icon.
          */
         public static function img($type, $name){
             $pad = 1;

application/helper/HTML_Helper.php

@@ -266,7 +266,6 @@
             $html .= "<td class='grind'>\n";
             $html .= "</td>\n";
             $html .= "</tr>\n";
-            $substats = array($rune->substat_1, $rune->substat_2, $rune->substat_3, $rune->substat_4);
             $substats_name = array($rune->substat_1_name, $rune->substat_2_name, $rune->substat_3_name, $rune->substat_4_name);
             $substats_value = array($rune->substat_1_value, $rune->substat_2_value, $rune->substat_3_value, $rune->substat_4_value);
             $substats_grind = array($rune->substat_1_grind, $rune->substat_2_grind, $rune->substat_3_grind, $rune->substat_4_grind);
@@ -484,73 +483,6 @@
             }
             $html .= "</table>\n";
             $html .= "</td>\n";
-            // Details
-            /* TODO: Only quaity data, and for that the icon is enough
-            $html .= "<td class='details'>\n";
-            $html .= "<table class='table_details'>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            $html .= "Quality:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            $html .= "<span class='quality quality_" . strtolower($artifact->quality_name) . "'>\n";
-            $html .= $artifact->quality_name . "\n";
-            $html .= "</span>\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            $html .= "Original q.:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            $html .= "<span class='quality quality_" . strtolower($artifact->original_quality_name) . "'>\n";
-            $html .= $artifact->original_quality_name . "\n";
-            $html .= "</span>\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            // TODO: No data on value yet
-            $html .= ""; //"Value:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            // TODO: No data on value yet
-            $html .= ""; //number_format($artifact->value, 0, ".", ",") . "\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //"Efficiency:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //number_format($artifact->efficiency, 2, ".", ",") . "%\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //"Max. eff.:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //number_format($artifact->max_efficiency, 2, ".", ",") . "%\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "<tr>\n";
-            $html .= "<td class='title'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //"Reached. eff.:\n";
-            $html .= "</td>\n";
-            $html .= "<td class='value'>\n";
-            // TODO: No data on efficiencies yet
-            $html .= ""; //number_format($artifact->efficiency * 100 / $artifact->max_efficiency, 2, ".", ",") . "%\n";
-            $html .= "</td>\n";
-            $html .= "</tr>\n";
-            $html .= "</table>\n";
-            */
-            $html .= "</td>\n";
             $html .= "</tr>\n";
             $html .= "</table>\n";
             return $html;

application/page/Error_Page.php

@@ -0,0 +1,59 @@
+<?php
+    /**
+     * Landing (login) page file.
+     *
+     * Provides a class with all the properties and methods to display the page.
+     *
+     * @category Page
+     */
+
+    /**
+     * Require dependent files if not present.
+     */
+    require_once(PATH::PAGE . "Page.php");
+
+    /**
+     * Error page model.
+     *
+     * @category Page
+     */
+    class Error_Page extends Page{
+
+        /**
+         * @var int Error code.
+         *
+         * HTTP status code.
+         */
+        public $code = 500;
+
+        /**
+         * Constructor.
+         *
+         * Retrieves the data and initializes the variables.
+         * 
+         * @param int code Error code. Optional.
+         */
+        public function __construct($code = null){
+            $this->view = PATH::VIEW . "error.php";
+            $this->title = "Error - SWDB";
+            
+            if (null == $code || intval($code) < 200 || intval($code) > 599){
+                $code = 500;
+            }
+            switch(intval($code)){
+                case 400:
+                    $this->description = "Invalid request";
+                    break;
+                case 404:
+                    $this->description = "Not found";
+                    break;
+                case 500:
+                    $this->description = "Server error";
+                    break;
+                default:
+                    $this->description = "Unknown error";
+            }
+            $this->code = intval($code);
+        }
+    }
+?>

application/page/Fusion_Page.php

@@ -21,7 +21,7 @@
     class Fusion_Page extends Page{
 
         /**
-         * @var \K_Fusion[] List of top-level fusions to display.
+         * @var \Fusion[] List of top-level fusions to display.
          */
         public $fusion = [];
 

application/page/Landing_Page.php

@@ -19,19 +19,25 @@
      */
     class Landing_Page extends Page{
 
+        /**
+         * @var string Error message to show when login was unsuccesfull and
+         * the user is back in the login page
+         */
+        public $error_message = "";
+
         /**
          * Constructor.
          *
          * Retrieves the data and initializes the variables.
-         *
-         ** @global resource Database connection.
          */
         public function __construct(){
-            global $db;
             $this->view = PATH::VIEW . "landing.php";
             $this->title = "Login - SWDB";
             $this->description = "Login to SWDB";
             $this->canonical = URL::BASE . "landing/";
+            if (http_response_code() == 401){
+                $this->error_message = "Invalid credentials";
+            }
         }
     }
 ?>

application/page/Monster_Info_Page.php

@@ -41,10 +41,8 @@
          * Retrieves the data and initializes the variables.
          *
          * @param int $id Monster id. Can be any of the awakening stages
-         * @global resource Database connection.
          */
         public function __construct($id){
-            global $db;
             $this->view = PATH::VIEW . "monster_info.php";
             $title = "";
             $monster = new K_Unit($id);

application/page/Monster_Page.php

@@ -32,10 +32,8 @@
          * Retrieves the data and initializes the variables.
          *
          * @param string $id Selected unit id
-         * @global resource Database connection.
          */
         public function __construct($id){
-            global $db;
             $this->view = PATH::VIEW . "monster.php";
             $this->unit = new Unit($id);
             $this->title = $this->unit->unit->name ." - SWDB";

application/page/Monsters_Page.php

@@ -118,11 +118,9 @@
          *
          * @return string The query to be executed.
          * @global int Player ID.
-         * @global resource Database connection.
          */
         private function build_query(){
             global $UID;
-            global $db;
             $s = "
                 SELECT unit.id AS id
                 FROM

application/page/Optimizer_Page.php

@@ -56,7 +56,7 @@
          * Builds the query to the rune table using the selected or default
          * filters.
          *
-         * @return The query to be executed.
+         * @return string The query to be executed.
          */
         private function build_query(){
             global $UID;

application/page/Stats_Page.php

@@ -90,7 +90,6 @@
         public function __construct(){
             global $UID;
             global $db;
-            $best_run = null;
             $this->view = PATH::VIEW . "stats.php";
             $this->title = "Stats - SWDB";
             $this->description = "Player statistics";
@@ -104,12 +103,6 @@
                 return;
             }
 
-            // TODO DEBUG Force NB10
-            /*$this->filters["AREA"] = 6001;
-            $this->filters["AREA_TYPE"] = 2;
-            $this->filters["STAGE"] = 10;*/
-            // TODO END DEBUG
-
             // Build query modifier:
             $query_where = "
               run.uid = '$UID' AND

application/page/Teams_Page.php

@@ -49,12 +49,13 @@
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->teams, new Team($r["id"]));
             }
-            $s = "
+            $statement = $db->prepare("
               SELECT id
               FROM unit
-              WHERE unit.uid = '$UID';
-            ";
-            $q = $db->query($s);
+              WHERE unit.uid = :uid;
+            ");
+            $statement->bindValue(':uid', $UID, SQLITE3_INTEGER);
+            $q = $statement->execute();
             while ($r = $q->fetchArray(SQLITE3_ASSOC)){
                 array_push($this->units, new Unit($r["id"], false));
             }
@@ -82,10 +83,9 @@
          * Builds the query to the rune table using the selected or default
          * filters.
          *
-         * @return The query to be executed.
+         * @return string The query to be executed.
          */
         private function build_query(){
-            global $ELEMENT;
             global $UID;
             $s = "
               SELECT id

application/view/artifacts.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Artifacts_Page $page The page model.
+     * @var Artifacts_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -72,8 +73,8 @@
 ?>
                             </select>
                         </td>
-                    <tr>
                     </tr>
+                    <tr>
                         <td class='label'>
                             Type:
                         </td>

application/view/catalog.php

@@ -5,8 +5,8 @@
      * Contains the view layout and some code to present the data
      *
      * @category View
-     * @property_read Catalog_Page $page The page model
-     * @property_read int $UID Player ID
+     * @var Catalog_Page $page The page model
+     * @var int $UID Player ID
      */
 ?>
 <!DOCTYPE html>

application/view/enchantments.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Artifacts_Page $page The page model.
+     * @var Artifacts_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -220,9 +221,7 @@
                 <div id='filter_apply'>
                     <input type='submit' value='Apply'/>
                 </div>
-                </div>
             </form>
-
         </aside> <!-- #filters -->
         <main>
             <section class='content' id='enchantments'>

application/view/error.php

@@ -0,0 +1,45 @@
+<?php
+    /**
+     * Error view.
+     *
+     * Contains the view layout and some code to present the data.
+     *
+     * @category View
+     * @var Landing_Page $page The page model.
+     */
+?>
+<!DOCTYPE html>
+<html lang='en'>
+    <head>
+        <meta content='text/html; charset=utf-8' http-equiv='content-type'/>
+        <meta name='viewport' content='width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1'/>
+        <title><?=$page->title?></title>
+        <link rel='shortcut icon' href='<?=$page->favicon?>'/>
+        <!-- CSS files -->
+        <link rel='stylesheet' type='text/css' href='<?=URL::CSS?>ui.css'/>
+        <link rel='stylesheet' type='text/css' href='<?=URL::CSS?>error.css'/>
+        <!-- Meta tags -->
+        <meta name='robots' content='noindex nofollow'/>
+    </head>
+    <body>
+<?php
+        include __DIR__ . "/inc/header.php";
+?>
+        <aside>
+        </aside>
+        <main>
+            <section class='list'>
+                <h2>
+                    Error
+                </h2>
+                <article>
+                    Error <?=$page->code?>: <?=$page->description?>
+                </article>
+            </section> <!-- #catalog -->
+        </main>
+
+<?php
+        include __DIR__ . "/inc/footer.php";
+?>
+    </body>
+</html>

application/view/fusion.php

@@ -5,8 +5,8 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Fusion_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Fusion_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>

application/view/guild.php

@@ -5,7 +5,7 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Guild_Page $page The page model.
+     * @var Guild_Page $page The page model.
      */
 ?>
 <!DOCTYPE html>

application/view/help.php

@@ -5,7 +5,7 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Page $page The page model.
+     * @var Page $page The page model.
      */
     // TODO: Implement
 ?>

application/view/home.php

@@ -5,7 +5,9 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Home_Page $page The page model.
+     * @var Home_Page $page The page model.
+     * @var int $UID User id.
+     * @var int[] $EFFECT_AREA Required constants.
      */
 ?>
 <!DOCTYPE html>
@@ -484,7 +486,6 @@
 <?php
                                                     }
                                                     if ($party instanceof K_Unit){
-                                                        $enable_save = false;
                                                         $disabled = "disabled";
                                                     }
                                                     else{

application/view/inc/header.php

@@ -6,6 +6,8 @@
      *
      * @category View
      */
+
+    /** @var int $UID User id. */
 ?>
 <header>
     <div id='logo'>

application/view/landing.php

@@ -5,7 +5,7 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Landing_Page $page The page model.
+     * @var Landing_Page $page The page model.
      */
 ?>
 <!DOCTYPE html>
@@ -77,6 +77,17 @@
                                     <input type='submit' value='Go'/>
                                 </td>
                             </tr>
+<?php
+                            if ($page->error_message != ""){
+?>
+                                <tr>
+                                    <td class='error' colspan='2'>
+                                        <?=$page->error_message?>
+                                    </td>
+                                </tr>
+<?php
+                            }
+?>
                         </table>
                     </form>
                 </article>

application/view/monster.php

@@ -5,8 +5,8 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Monster_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Monster_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>
@@ -66,7 +66,7 @@
 ?>
                 <div id='monster_details'>
                     <div id='exp'>
-                        <span id='exp_bar' style='width:<?=$exp_pct?>%'></span>
+                        <span id='exp_bar' style='width:<?=$exp_pct?>%'>
                         </span>
                         <span id='exp_text'>
                             <?=$exp_txt?>

application/view/monster_info.php

@@ -5,8 +5,9 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Monster_Info_Page The page model.
+     * @var Monster_Info_Page $page The page model.
      */
+
 ?>
 <!DOCTYPE html>
 <html lang='en'>
@@ -55,7 +56,7 @@
 ?>
                     <a href='#section_<?=$i?>'>
                         <div class='monster_panel'>
-                            <?=HTML::unit_panel($page->monster[$i])?>
+                            <?=HTML::unit_panel($monster)?>
                         </div>
                     </a>
 <?php

application/view/monsters.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Monsters_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Monsters_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>
@@ -109,7 +109,7 @@
                             }
 ?>
                             <input type='checkbox' name='without_runes' id='filter_without_runes' <?=$checked?>/>
-                            <label for='filter_without_runes'>Monsters without runes<label>
+                            <label for='filter_without_runes'>Monsters without runes</label>
                         </td>
                     </tr>
                     <tr>

application/view/optimizer.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Teams_Page $page The page model.
-     * @property_read int $page Player ID.
+     * @var Teams_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>

application/view/optimizer_unit.php

@@ -5,8 +5,8 @@
      * Contains the view layout and some code to present the data.
      *
      * @category View
-     * @property_read Monster_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Monster_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>
@@ -1125,14 +1125,6 @@
                     <?=HTML::unit_panel($page->unit)?>
                 </div>
 <?php
-                if ($page->unit->experience_level != 0){
-                    $exp_pct = ceil($page->unit->exp_gained * 100 / $page->unit->experience_level);
-                    $exp_txt = $page->unit->exp_gained . " / " . $page->unit->experience_level;
-                }
-                else{
-                    $exp_pct = 100;
-                    $exp_txt = "MAX";
-                }
                 $now = time();
                 //$datediff = $now - $page->unit->create_time->getTimestamp();
                 $datediff = $now - strtotime($page->unit->create_time->format('Y-m-d H:i:s'));
@@ -1497,7 +1489,7 @@
                             </td>
                             <td class='value'>
                                 <input id='min_hp' type='range' value='<?=$page->unit->total_hp?>' min='<?=$page->unit->hp?>' max='50000' oninput='updateMinValue("hp", this);'>
-                                <input type='number' id='lbl_min_hp' value='<?=$page->unit->total_hp?>' min='<?=$page->unit->hp?>' max='50000' onChange='updateMinValue("hp", this);'></input></input><span class='slider_percent'> </span>
+                                <input type='number' id='lbl_min_hp' value='<?=$page->unit->total_hp?>' min='<?=$page->unit->hp?>' max='50000' onChange='updateMinValue("hp", this);'></input><span class='slider_percent'> </span>
                                 <a title='Remove filter' class='filter_control a_button' onclick='removeFilter("hp");'>
                                     <img alt='Remove filter' src='<?=URL::IMG["ICON"]?>nok.png'/>
                                 </a>

application/view/profile.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Profile_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Profile_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>
@@ -277,7 +277,7 @@
                                 Visibility:
                             </td>
                             <td id='visibility'>
-                                <input type='checkbox' name='defeat' id='filter_defeat' <?=$checked?> onChange='toggleVisibility(this.value);'/>
+                                <input type='checkbox' name='visible' onChange='toggleVisibility(this.value);'/>
                                 <label for='filter_defeat'>Public profile</label>
                                 <div class='help_tooltip'>
                                     <p>

application/view/report.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Report_Page $page The page model.
+     * @var Report_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>

application/view/report_rune_enchantment.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Report_Rune_Enchantment_Page $page The page model.
+     * @var Report_Rune_Enchantment_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -444,7 +445,7 @@
                                     }
 ?>
                                 </select>
-                            </td>
+                            </div>
                         </td>
                     </tr>
                 </table>
@@ -455,7 +456,7 @@
             <section id='results' class='content'>
                 <h2>
                     <span>
-                        <?=$upgrade["unit"]->title?>
+                        Available enchantments
                     </span>
                 </h2>
                 <table id='results'>
@@ -464,7 +465,7 @@
     ?>
                         <tr>
                             <td class='header' colspan='2'>
-                                <a href='/<?=$UID?>/monsters/<?=$unit->id?>/' target='_blank'>
+                                <a href='/<?=$UID?>/monsters/<?=$upgrade["unit"]->id?>/' target='_blank'>
                                     <div class='monster_panel'>
                                         <?=HTML::unit_panel($upgrade["unit"])?>
                                     </div>

application/view/report_skillup.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Report_Skillup_Page $page The page model.
+     * @var Report_Skillup_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -119,7 +120,6 @@
                                         Include monsters that have family members with less stars than seleced in the stars filters.
                                     </p>
                                 </div>
-                                </span>
                             </td>
                         </tr>
                         <tr>
@@ -216,7 +216,7 @@
                             case 11:
                             case 12:
                             case 13:
-                                $index_title = $index . "<span class='superindex'>th</span> - " . $unit_title;
+                                $index_title = $index . "<span class='superindex'>th</span> - " . $unit->title;
                                 break;
                         }
 ?>

application/view/runes.php

@@ -5,7 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Runes_Page $page The page model.
+     * @var Runes_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -196,6 +197,7 @@
                             <input type='number' name='max_efficiency' id='filter_efficiency_max' min='0' max='100' value='<?=$page->filters["MAX_EFFICIENCY"]?>'/>%
                         </td>
                     </tr>
+                    <tr>
                         <td class='label'>
                             Max. eff.:
                         </td>

application/view/runs.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Runs_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Runs_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>
@@ -322,9 +322,6 @@
                                     </div>
                                 </td>
                                 <td class='date'>
-<?php
-                                    $date = date_create($run->dtime);
-?>
                                     <?=date("Y/m/d H:i:s", $run->dtime);//date_format($date, "Y/m/d H:i:s")?>
                                 </td>
                                 <td class='team'>

application/view/stats.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Stats_Page $page The page model.
-     * @property_read int $UID Player ID.
+     * @var Stats_Page $page The page model.
+     * @var int $UID Player ID.
      */
 ?>
 <!DOCTYPE html>

application/view/teams.php

@@ -5,8 +5,8 @@
      * Contains the view layout and ome code to present the data.
      *
      * @category View
-     * @property_read Teams_Page $page The page model.
-     * @property_read int $page Player ID.
+     * @var Teams_Page $page The page model.
+     * @var int $UID User id.
      */
 ?>
 <!DOCTYPE html>
@@ -969,6 +969,7 @@
                             </div>
                             <input id='new_unit_id' class='no_remove' onInput='searchUnit();'/>
                             <div id='new_unit_autocomplete' class='no_remove new_unit_autocomplete'>
+                            </div>
                         </td>
                     </tr>
                     <tr>

public/css/error.css

@@ -1,43 +0,0 @@
-div.section{
-    width: 60%;
-    min-width: 20em;
-    max-width: 80em;
-    margin: auto;
-}
-
-table#error_header{
-    width: 80%;
-    margin: 2em auto 2em auto;
-}
-
-table#error_header td{
-    width: 50%;
-}
-
-table#error_code{
-    display: inline-block;
-    margin-left: 10%;
-    border: 0.1em solid #000011;
-    border-radius: 1em;
-    padding: 0.5em 0 0.5em 0;
-    background-color: #1e9957;
-    filter: drop-shadow(0 0 0.4em #002200);
-    color: #ffffff;
-}
-
-td#error_number{
-    font-size: 300%;
-    border-right: 0.063em solid #000000;
-    padding-right: 0.5em;
-    padding-left: 0.2em;
-}
-td#error_tag{
-    font-size: 110%;
-    padding-left: 1.2em;
-    padding-right: 1em;
-}
-div#error_message{
-    width: 80%;
-    margin: 0 10% 1em 10%;
-    margin-bottom: 4em;
-}

public/error.php

@@ -1,59 +0,0 @@
-<?php
-    /**
-     * Error page.
-     *
-     * Loaded from the {@see Constroller} when an error occurs.
-     *
-     * @category Public
-     */
-
-    require_once(__DIR__ . "/../application/config.php");
-?>
-<!DOCTYPE html>
-<html lang='en'>
-    <head>
-        <meta content='text/html; charset=windows-1252' http-equiv='content-type'/>
-        <meta name='viewport' content='width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1'>
-        <title>ERROR <?=http_response_code()?> - SWDB</title>
-        <link rel='shortcut icon' href='<?=$root?>img/layout/logo/favicon.ico'>
-        <link rel='stylesheet' type='text/css' href='<?=$path["css"]?>ui.css'/>
-        <link rel='stylesheet' type='text/css' href='<?=$path["css"]?>error.css'/>
-        <meta name="robots" content="noindex follow"/>
-    </head>
-    <body>
-<?php
-        include __DIR__ . "/../application/inc/header.php";
-?>
-        <div class='section'>
-            <h3 class='section_title'>ERROR</h3>
-            <table id='error_code' class='entry'>
-                <tr>
-                    <td id='error_number'>
-                        <?=http_response_code()?>
-                    </td>
-                    <td id='error_tag'>
-                        ERROR
-                        <br/>
-                        CODE
-                    </td>
-                <tr>
-            </table>
-            <div id='error_message' class='entry'>
-                <ul>
-                    <li>
-                        <a href='javascript:location.reload();'>Reload</a>
-                    </li>
-                    <li>
-                        <a href='javascript:history.go(-1);'>Back to previous page</a>
-                    </li>
-                    <li>
-                        <a href='<?=$root?>'>Home Page</a>
-                    </li>
-                </ul>
-            </div> <!-- #error_message -->
-        </div> <!-- .section -->
-<?php
-        include __DIR__ . "/../application/inc/footer.php";
-?>
-    </body>
-</html>

public/index.php

@@ -11,5 +11,5 @@
 
     $request = parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH);
     $params = explode('/', $request);
-    $controller = new Controller($params);
+    new Controller($params);
 ?>