Дыры в вап чате

<?
require'config.php';
if (!ctype_digit($_GET['rm'])){header('Location: index?'.SID);die;}
$rm = intval($_GET['rm']);
$user['avr'] = 0;
$align='left';
$title='Сказать';
aut();
head();
 
$rooms = $db->sql_fetchrow($db->sql_query("SELECT * FROM `rooms` WHERE `rm` = '$rm'"));
 
if ($rooms['intim']==1){
if(!isset($_POST['inps']) && isset($_SESSION['inps']))$inps = check(intval($_SESSION['inps']));
else $inps = check(intval($_POST['inps']));
$_SESSION['inps'] = $inps;
}
if(empty($inps)) $inps = 0;
 
 
if (($rooms['sartir']!=1) && ($user['kik']>$time)){
echo '<b>'.user($user['whokik']).'</b> выпнул вас из чата на <b>'.kikt($user['kik']).'</b> <br />Причина: <b>'.$user['whykik'].'</b><br />';
$rooms = $db->sql_query("SELECT * FROM `rooms` WHERE sartir = '1' ORDER BY `pos` ASC");
if($db->sql_numrows($rooms)!=0)echo 'Вам разрешен доступ только в<br />';
while($room = $db->sql_fetchrow($rooms)){
if ($room['level']<=$user['level'])echo '<a href="room?rm='.$room['rm'].'">'.$room['name'].'</a><br />';}
echo '<br />';
echo gbinroom.'<a href="enter">Прихожая</a>'.div;
foot();
}
 
if (empty($act)){
if ($ver!='wml')echo '<form action="tell?rm='.$rm.'&amp;act=add&amp;'.SID.'" method="post">';
if ($ver=='wml')echo '<br/><input name="msg'.$ref.'" maxlength="512" title="Text"/><br/>';
else echo'<br><textarea cols="70" rows="12" name="msg"></textarea><br /><br>';
 
if ($user['dd']!=0){
if ($user['level']>=4){
echo '<select name="dd">
<option value="0" selected="selected">Шрифт</option>
<option value="1">Наклонный</option>';
if ($user['level']>=5) echo '<option value="2">Подчёркнутый</option>';
if ($user['level']>=6) echo '<option value="3">Накл. и подч.</option>';
if ($user['level']>=6) echo '<option value="4">Жирный</option>';
if ($user['level']>=7) echo '<option value="5">Жирн. и подч.</option>';
if ($user['level']>=7) echo '<option value="6">Огромный</option>';
echo '</select><br />';
}
}
if ($user['emo']!=0){
echo '<select name="emo">
<option value="0" selected="selected">Эмоции</option>
<option value="1">Радостно</option>
<option value="2">Печально</option>
<option value="3">Удивленно</option>
<option value="4">Ласково</option>
<option value="5">Смущенно</option>
<option value="6">Кокетливо</option>
<option value="7">Обиженно</option>
<option value="8">Настойчиво</option>
<option value="9">Шепотом</option>
<option value="10">Задумчиво</option>
<option value="11">Злобно</option>
</select><br />';
}
 
if ($user['color']!=0){
echo '<select name="color">
<option value="0" selected="selected">Цвет</option>
<option value="1">Красный</option>
<option value="2">Синий</option>
<option value="3">Сереневый</option>
<option value="4">Зеленый</option>
</select><br />';
}
 
if ($ver=='wml'){
echo '<br /><anchor title="go">Сказать<go href="tell?rm='.$rm.'&amp;act=add&amp;'.SID.'" method="post">';
echo '<postfield name="msg" value="$msg'.$ref.'"/>
<postfield name="dd" value="$dd"/>
<postfield name="emo" value="$emo"/>
<postfield name="color" value="$color"/>
</go></anchor>';
echo '<br/><br />';
}else{
echo '<br /><input type="submit" class="ibutton" value="Сказать"/></form><br /><br />';
}
 
 
 
}else{
$msg = check($_POST['msg']);
$dd = check($_POST['dd']);
$emo = check($_POST['emo']);
$color = check($_POST['color']);
$prvt = check($_POST['prvt']);
 
if(isset($_GET['nk'])) $nk = intval($_GET['nk']);
else $nk = 0;
 
if($prvt!=0){
if(isset($_POST['prvt']) && isset($_GET['nk'])) $privat = intval($_GET['nk']);
}else $privat = 0;
 
if (strlen2($msg)<2){header ('Location: room?rm='.$rm.'&'.SID); exit;}
 
$msg = iconv('utf-8', 'windows-1251', $msg);
$msg = substr($msg,0,512);
$msg = iconv('windows-1251', 'utf-8', $msg);
if ($user['translit']==1)$msg = translit($msg);
 
$mess=$db->sql_fetchfield($db->sql_query("select COUNT(*) from message WHERE `user_id` = '$user[id]'  and `time`>'".($time - $rooms['flyd'])."';"),0);
if ($mess > 0){ header ('Location: room?rm='.$rm.'&err=t&'.SID.''); exit;}
 
if ($rooms['inkog']!=0){
$db->sql_query ("INSERT INTO message (user,user_id,time,msg,rm,emo,bb,color,komu,privat) VALUES ('Аноним','0','$time','$msg','$rm','$emo','$dd','$color','$nk','$privat')");
}else{
$db->sql_query ("INSERT INTO message (user,user_id,time,msg,rm,emo,bb,color,komu,privat,inps) VALUES ('$user[user]','$user[id]','$time','$msg','$rm','$emo','$dd','$color','$nk','$privat','$inps')");
}
 
posts_add();
 
if ($rooms['umnik']!=0) require H.'bots/umnik3.php';
if ($rooms['tupica']!=0) require H.'bots/umnikmat2.php';
if ($rooms['tupica']!=0) require H.'bots/tupica2.php';
if ($rooms['flyder']!=0) require H.'bots/flyder.php';
 
header ('Location: room?rm='.$rm.'&'.SID);exit;
 
}
 
 
echo gb.'<a href="room?rm='.$rm.'">В чат </a>'.div;
 
foot();
?>