Bank bug criminolz

<?php
echo'
		<div id="content_top"> </div>


		<div id="content">


<h1 class="titel">Bank</h1>';


  if($own['bankpas'] == 0) {
    echo"Je hebt geen bankpas!";
  } else {
  
  //Tab javascript instellen.


  echo'
    <script type="text/javascript">
    currenttab = \'tab1\';
    function settab(tabid) {
      if(tabid != currenttab) {
        document.getElementById(currenttab).className = \'tab\';
        document.getElementById(tabid).className = \'tab_active\';
        document.getElementById(tabid + \'_span\').style.display =\'\';
        document.getElementById(currenttab + \'_span\').style.display =\'none\';
        currenttab = tabid;
      }
    }
    </script>';
    
    
  //Tabbladen weergeven.
  echo'
  <table width="100%">
    <tr align="center">
      <td align="center"><a id="tab1" class="tab_active" onclick="settab(\'tab1\'); updatecash(); return false;" href="#">Pinnen</a></td>
      <td align="center"><a id="tab2" class="tab" onclick="settab(\'tab2\'); return false;" href="#">Storten</a></td>
      <td align="center" style="display: none"><a id="tab3" class="tab" onclick="settab(\'tab3\')" href="#">Donatie maken</a></td>
    </tr>
  </table><br /><br />';
  
  
  //Rentes
  if($own['vip'] > 0) {
    $rente = 5;         //Voor VIPS: 5% rente.
  } else {
    $rente = 3;         //Voor non-VIPS/non-rentedagen: 3% rente.
  }
  
  if($own['rentedagen'] > 0) {
    $rente = 10;        //Voor rentedagen: 10% rente.
  }
  
  
  //Tabblad 1: Geld pinnen (Ophalen van de bank)
  echo'<span id="tab1_span">';


  //Tabblad 2: Geld storten (storten op bank)
  echo'<span id="tab2_span">';
    if(isset($_POST['stort'])) {
      $fout = array();


      $_POST['money'] = str_replace(".", "", $_POST['money']);


      if($own['bank'] < $_POST['money']) {
        $fout[] = ' - Zoveel geld heb je niet op de bank.';
      }


      if(!is_numeric($_POST['money']) || $_POST['money'] <= 0) {
        $fout[] = ' - Je moet een geldig bedrag invullen!';
      }


      if(empty($fout[0])) {
        $own['cash'] += $_POST['money'];
        $own['bank'] -= $_POST['money'];
        mysql_query("UPDATE users SET cash = '" . $own['cash'] . "', bank = '"  . $own['bank'] . "' WHERE id = '" . $own['id'] . "'");
        echo "<div class=\"dark\" id=\"message\"><font color=\"green\" style=\"font-weight: bold\">Het bedrag is van je bankrekening gehaald.</font></div><br />";
      } else {
        foreach($fout as $tekst) {
          @$foutje .= "<br />\r\n" . $tekst;
        }
        echo "<div class=\"dark\" id=\"message\"><font color=\"red\" style=\"font-weight: bold\">De volgende dingen gingen verkeerd:</font>" . $foutje . "</div><br />";
      }
    }
    
    echo'
    <form method="post">
         <table>
           <tr>
             <td><b>Rente:</b></td>
             <td style="padding-left: 10px">' . $rente . '%</td>
           </tr>


           <tr>
             <td><b>Contant:</b></td>
             <td style="padding-left: 10px" id="cash">&euro; ' . groot($own['cash']) . ',-</td>
           </tr>


           <tr>
             <td><b>Bank:</b></td>
             <td style="padding-left: 10px" id="bank">&euro; ' . groot($own['bank']) . ',-</td>
           </tr>


           <tr>
             <td><b>Bedrag:</b></td>
             <td style="padding-left: 10px"><input type="text" name="money" class="input" value="' . $own['bank'] . '"></td>
           </tr>


           <tr>
             <td>&nbsp;</td>
             <td style="padding-left: 10px"><input type="submit" name="haal" class="submit" value="Halen"></td>
           </tr>
         </table>
    </form>
    </span>';


    //Tabblad 2: Geld storten


    echo'<span id="tab2_span" style="display: none">';
    
    if(isset($_POST['stort'])) {
      echo"\r\n<script type=\"text/javascript\">\r\nsettab('tab2');\r\n</script>\r\n";
      $fout = array();
      $_POST['money'] = str_replace(".", "", $_POST['money']);
      if($own['cash'] < $_POST['money']) {
        $fout[] = ' - Zoveel geld heb je niet contant staan.';
      }


      if(!is_numeric($_POST['money']) || $_POST['money'] <= 0) {
        $fout[] = ' - Je moet een geldig bedrag invullen!';
      }


      if($own['storten'] <= 0) {
        $fout[] = ' - Je kunt vandaag niet meer storten.';
      }
      
      if(empty($fout[0])) {
        $own['storten']--;
        $own['cash'] -= $_POST['money'];
        $own['bank'] += $_POST['money'];
        mysql_query("UPDATE users SET cash = '" . $own['cash'] . "', bank = '"  . $own['bank'] . "', storten = '" . $own['storten'] . "' WHERE id = '" . $own['id'] . "'");
        echo "<div class=\"dark\" id=\"message\"><font color=\"green\" style=\"font-weight: bold\">Het bedrag is op je bankrekening gestort.</font></div><br />";
      } else {
        foreach($fout as $tekst) {
          @$foutje .= "<br />\r\n" . $tekst;
        }
        echo "<div class=\"dark\" id=\"message\"><font color=\"red\" style=\"font-weight: bold\">De volgende dingen gingen verkeerd:</font>" . $foutje . "</div><br />";
      }
    }


    echo'
    Je kunt nog <b>' . $own['storten'] . '</b> keer storten vandaag.
    <br /><br />
    <form method="post">
         <table>
           <tr>
             <td><b>Rente:</b></td>
             <td style="padding-left: 10px">' . $rente . '%</td>
           </tr>


           <tr>
             <td><b>Contant:</b></td>
             <td style="padding-left: 10px">&euro; ' . groot($own['cash']) . ',-</td>
           </tr>
           
           <tr>
             <td><b>Bank:</b></td>
             <td style="padding-left: 10px">&euro; ' . groot($own['bank']) . ',-</td>
           </tr>
           
           <tr>
             <td><b>Bedrag:</b></td>
             <td style="padding-left: 10px"><input type="text" name="money" class="input" value="' . $own['cash'] . '"></td>
           </tr>


           <tr>
             <td>&nbsp;</td>
             <td style="padding-left: 10px"><input type="submit" name="stort" class="submit" value="Storten"></td>
           </tr>
         </table>
    </form>
    </span>';
    
    //Tabblad 3: Geld doneren. Komt later misschien.
    
    echo'
    <span id="tab3_span" style="display: none">
    De mogelijkheid om geld te doneren is nog niet ingesteld, omdat dit vrij fraudegevoelig is. Hier moet eerst aan gewerkt worden.
    </span>';
  }
  echo'
  <script type="text/javascript">
    function updatecash() {
      document.getElementById("cash").innerHTML = "&euro; ' . groot($own['cash']) . ',-";
      document.getElementById("bank").innerHTML = "&euro; ' . groot($own['bank']) . ',-";
      frm = document.forms[0];
      frm.money.value = "' . $own['bank'] . '";
    }
  </script>


		</div>
		<div id="content_bottom"> </div>';
?>