[Dankki]

You should mysql_real_escape_string the values before trying to check them from the db.

[Bassline]

Perhaps:

Code

<?php
include("lib.php");
$player = check_user($secret_key, $db);
if($player->rank != "Administrador")
{
header("Location: personagem.php");
exit;
}
include("templates/private_header.php");
head("Admin Panel","adminpanel.png");
startbox();
if(isset($_GET['page']))
{
include("admin/" . $_GET['page'] . ".php");
}
else
{
?>
<A href="admin.php?page=code1">Kill Players</a><br>
<A href="admin.php?page=code2">Heal Players</a><br>

<?php
}
endbox();
include("templates/footer.php");
?>
i want to know if im prone to hacking. the code1.php and code2.php uses a custom query library that is included in lib.php so there is no way to execute them directly without falling in to an error.

Also in My template i have:

if($player->rank == "Administrador")
{
echo "<a href='admin.php'>Admin Panel</a>";
}

Taken from:
http://stackoverflow.com/questions/66500...ation-page

[systemcarnage]

you could encrypt the data that is being transferred from client to server or other way around..