Incremental Refactor Templates

2026-09-19 16:47:25 +00:00 · 2026-05-06 13:16:54 +03:00
parent 544496c515
commit a02be51969
59 changed files with 7542 additions and 3364 deletions
@@ -1,23 +1,74 @@
-<?php if($session->alliance == $aid && $session->alliance > 0) {
+<?php
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        alli_menu.tpl                                                  ##
+## Description: Alliance menu navigation                                       ##
+## Improvements:                                                               ##
+##  - Reduced duplication                                                      ##
+##  - Safer input handling                                                     ##
+##  - Cleaner structure                                                        ##
+##  - Added comments                                                           ##
+#################################################################################
+
+// Verifică dacă jucătorul este în alianța curentă
+if ($session->alliance == $aid && $session->alliance > 0) {
+
+    // Preluăm parametrul "s" o singură dată (GET sau POST)
+    // Cast la int pentru siguranță
+    $s = 0;
+    if (isset($_GET['s'])) {
+        $s = (int)$_GET['s'];
+    } elseif (isset($_POST['s'])) {
+        $s = (int)$_POST['s'];
+    }
 ?>
 <div id="textmenu">
-   <a href="allianz.php" <?php if(!isset($_GET['s']) && !isset($_POST['s'])) { echo "class=\"selected\""; } ?>>Overview</a>
- | <a href="allianz.php?s=2" <?php if(isset($_GET['s']) && $_GET['s'] == 2) { echo "class=\"selected\""; } ?>>Forum</a>
- | <a href="allianz.php?s=6" <?php if(isset($_GET['s']) && $_GET['s'] == 6) { echo "class=\"selected\""; } ?>>Chat</a>
- | <a href="allianz.php?s=3" <?php if(isset($_GET['s']) && $_GET['s'] == 3) { echo "class=\"selected\""; } ?>>Attacks</a>
- | <a href="allianz.php?s=4" <?php if(isset($_GET['s']) && $_GET['s'] == 4) { echo "class=\"selected\""; } ?>>News</a>
+
+    <!-- Overview -->
+    <a href="allianz.php" <?php if ($s === 0) { echo 'class="selected"'; } ?>>
+        Overview
+    </a>
+
+    | <!-- Forum -->
+    <a href="allianz.php?s=2" <?php if ($s === 2) { echo 'class="selected"'; } ?>>
+        Forum
+    </a>
+
+    | <!-- Chat -->
+    <a href="allianz.php?s=6" <?php if ($s === 6) { echo 'class="selected"'; } ?>>
+        Chat
+    </a>
+
+    | <!-- Attacks -->
+    <a href="allianz.php?s=3" <?php if ($s === 3) { echo 'class="selected"'; } ?>>
+        Attacks
+    </a>
+
+    | <!-- News -->
+    <a href="allianz.php?s=4" <?php if ($s === 4) { echo 'class="selected"'; } ?>>
+        News
+    </a>
+
 <?php
-if($session->sit == 0){
+    // Dacă NU este sitter → are acces la Options
+    if ($session->sit == 0) {
 ?>
- | <a href="allianz.php?s=5" <?php if(isset($_GET['s']) && $_GET['s'] == 5 || isset($_POST['s']) && $_POST['s']) { echo "class=\"selected\""; } ?>>Options</a>
+    | <!-- Options -->
+    <a href="allianz.php?s=5" <?php if ($s === 5) { echo 'class="selected"'; } ?>>
+        Options
+    </a>
 <?php
-}else{
+    } else {
 ?>
- | <span class=none><b>Options</b></span>
-<?php 
-}
+    | <!-- Options disabled for sitter -->
+    <span class="none"><b>Options</b></span>
+<?php
+    }
 ?>
+
 </div>
-<?php 
+<?php
 }
 ?>
@@ -1,57 +1,124 @@
 <?php
-if(!is_numeric($_SESSION['search'])) {
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        alliance.tpl                                                   ##
+## Description: Alliance ranking table                                         ##
+## Improvements:                                                               ##
+##  - Safer input handling                                                     ##
+##  - Removed duplicate function calls                                         ##
+##  - Fixed variable overwrite ($ranking)                                      ##
+##  - Cleaner pagination logic                                                 ##
+##  - Added comments                                                           ##
+#################################################################################
+
+// Validare search (poziția din ranking)
+if (!isset($_SESSION['search']) || !is_numeric($_SESSION['search'])) {
 ?>
-	<center><font color=orange size=2><p class=\"error\">The alliance <b>"<?php echo $_SESSION['search']; ?>"</b> does not exist.</p></font></center>
+    <center>
+        <font color="orange" size="2">
+            <p class="error">
+                The alliance <b>"<?php echo htmlspecialchars($_SESSION['search'] ?? '', ENT_QUOTES, 'UTF-8'); ?>"</b> does not exist.
+            </p>
+        </font>
+    </center>
 <?php
-    $search = $session->alliance;
+    $search = (int)$session->alliance;
+} else {
+    $search = (int)$_SESSION['search'];
 }
-else {
-$search = $_SESSION['search'];
+
+// Luăm ranking o singură dată (optimizare)
+$rankData = $ranking->getRank();
+$totalRanks = is_array($rankData) ? count($rankData) : 0;
+
+// Calcul paginare
+$start = 1;
+
+if (isset($_GET['rank']) && is_numeric($_GET['rank'])) {
+
+    $rankParam = (int)$_GET['rank'];
+
+    // Limităm la max ranking
+    if ($rankParam > $totalRanks) {
+        $rankParam = $totalRanks - 1;
+    }
+
+    $multiplier = 1;
+
+    // Determină pagina (20 / pagină)
+    while ($rankParam > (20 * $multiplier)) {
+        $multiplier++;
+    }
+
+    $start = 20 * $multiplier - 19;
+
+} else {
+    // fallback la sesiune
+    $start = isset($_SESSION['start']) ? ((int)$_SESSION['start'] + 1) : 1;
 }
 ?>
+
 <table cellpadding="1" cellspacing="1" id="alliance" class="row_table_data">
-			<thead>
-				<tr>
-					<th colspan="5">
-						The largest alliances						<div id="submenu"><a title="Top 10" href="statistiken.php?id=43"><img class="btn_top10" src="img/x.gif" alt="Top 10"></a><a title="defender" href="statistiken.php?id=42"><img class="btn_def" src="img/x.gif" alt="defender"></a><a title="attacker" href="statistiken.php?id=41"><img class="btn_off" src="img/x.gif" alt="attacker"></a></div>		    
-					</th>
-				</tr>
-		<tr><td></td><td>Alliance</td><td>Player</td><td>&Oslash;</td><td>Points</td></tr>
-		</thead><tbody>  
-        <?php
-        if(isset($_GET['rank'])){
-		$multiplier = 1;
-			if(is_numeric($_GET['rank'])) {
-				if($_GET['rank'] > count($ranking->getRank())) {
-				$_GET['rank'] = count($ranking->getRank())-1;
-				}
-				while($_GET['rank'] > (20*$multiplier)) {
-					$multiplier +=1;
-				}
-			$start = 20*$multiplier-19;
-			} else { $start = ($_SESSION['start']+1); }
-		} else { $start = ($_SESSION['start']+1); }
-        if(count($ranking->getRank()) > 0) {
-        	$ranking = $ranking->getRank();
-            for($i=$start;$i<($start+20);$i++) {
-            	if(isset($ranking[$i]['name']) && $ranking[$i] != "pad") {
-                	if($i == $search) {
-                    echo "<tr class=\"hl\"><td class=\"ra fc\" >";
-                    }
-                    else {
-                    echo "<tr><td class=\"ra \" >";
-                    }
-                    echo $i.".</td><td class=\"al \" ><a href=\"allianz.php?aid=".$ranking[$i]['id']."\">".$ranking[$i]['tag']."</a></td><td class=\"pla \" >";
-                    echo $ranking[$i]['players']."</td><td class=\"av \" >".$ranking[$i]['avg']."</td><td class=\"po \">".$ranking[$i]['totalpop']."</td></tr>";
-                }
-            }
-        }
-        else {
-        	echo "<td class=\"none\" colspan=\"5\">No alliance's found</td>";
-        }
-        ?>
- </tbody>
-</table>
+    <thead>
+        <tr>
+            <th colspan="5">
+                The largest alliances
+                <div id="submenu">
+                    <a title="Top 10" href="statistiken.php?id=43">
+                        <img class="btn_top10" src="img/x.gif" alt="Top 10">
+                    </a>
+                    <a title="defender" href="statistiken.php?id=42">
+                        <img class="btn_def" src="img/x.gif" alt="defender">
+                    </a>
+                    <a title="attacker" href="statistiken.php?id=41">
+                        <img class="btn_off" src="img/x.gif" alt="attacker">
+                    </a>
+                </div>
+            </th>
+        </tr>
+        <tr>
+            <td></td>
+            <td>Alliance</td>
+            <td>Player</td>
+            <td>&Oslash;</td>
+            <td>Points</td>
+        </tr>
+    </thead>
+
+    <tbody>
 <?php
+if ($totalRanks > 0) {
+
+    // Loop pe 20 rezultate
+    for ($i = $start; $i < ($start + 20); $i++) {
+
+        if (isset($rankData[$i]['name']) && $rankData[$i] !== "pad") {
+
+            // Highlight dacă e alianța căutată
+            $rowClass = ($i === $search) ? ' class="hl"' : '';
+
+            echo "<tr{$rowClass}>";
+            echo "<td class=\"ra fc\">{$i}.</td>";
+            echo "<td class=\"al\"><a href=\"allianz.php?aid=" . (int)$rankData[$i]['id'] . "\">" . htmlspecialchars($rankData[$i]['tag'], ENT_QUOTES, 'UTF-8') . "</a></td>";
+            echo "<td class=\"pla\">" . (int)$rankData[$i]['players'] . "</td>";
+            echo "<td class=\"av\">" . (int)$rankData[$i]['avg'] . "</td>";
+            echo "<td class=\"po\">" . (int)$rankData[$i]['totalpop'] . "</td>";
+            echo "</tr>";
+        }
+    }
+
+} else {
+
+    echo "<tr><td class=\"none\" colspan=\"5\">No alliance's found</td></tr>";
+
+}
+?>
+    </tbody>
+</table>
+
+<?php
+// Include search form
 include("ranksearch.tpl");
 ?>
@@ -1,140 +1,205 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        allidesc.tpl                                                   ##
+## Description: Alliance description + medals + edit form                      ##
+## Improvements:                                                               ##
+##  - Reduced unnecessary loops                                               ##
+##  - Safer output (XSS protection)                                            ##
+##  - Cleaner structure                                                       ##
+##  - Medals switch simplified                                                ##
+#################################################################################

+// fallback alliance id
+if (!isset($aid)) {
+    $aid = $session->alliance;
+}
+
+// load alliance data
 $varmedal = $database->getProfileMedalAlly($aid);
 $allianceinfo = $database->getAlliance($aid);
 $memberlist = $database->getAllMember($aid);
-$totalpop = 0;
+
+// build member id list (for population query)
 $memberIDs = [];

-foreach($memberlist as $member) {
-    $memberIDs[] = $member['id'];
-}
-$data = $database->getVSumField($memberIDs,"pop");
-
-if (count($data)) {
-    foreach ($data as $row) {
-        $totalpop += $row['Total'];
+if (!empty($memberlist)) {
+    foreach ($memberlist as $member) {
+        $memberIDs[] = (int)$member['id'];
    }
 }

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
+// total population calculation (safe fallback)
+$totalpop = 0;
+$data = [];
+
+if (!empty($memberIDs)) {
+    $data = $database->getVSumField($memberIDs, "pop");
+}
+
+if (!empty($data)) {
+    foreach ($data as $row) {
+        $totalpop += (int)$row['Total'];
+    }
+}
+
+// alliance title output (escaped)
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') . " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') . "</h1>";
+
+// menu include
 include("alli_menu.tpl");
 ?>
-<table cellpadding="1" cellspacing="1" id="edit"><thead>
+
 <form method="post" action="allianz.php">
 <input type="hidden" name="a" value="3">
 <input type="hidden" name="o" value="3">
 <input type="hidden" name="s" value="5">
+
+<table cellpadding="1" cellspacing="1" id="edit">
+
+<thead>
 <tr>
-<th colspan="3">Alliance</th>
-</tr><tr>
-<td colspan="2">Details</td>
-<td>Description</td>
-</tr></thead>
+    <th colspan="3">Alliance</th>
+</tr>
+<tr>
+    <td colspan="2">Details</td>
+    <td>Description</td>
+</tr>
+</thead>
+
 <tbody>

-<tr><td colspan="2"></td><td class="empty"></td></tr>
-
 <tr>
-<th>Tag</td><td class="s7"><?php echo $allianceinfo['tag']; ?></th>
-<td rowspan="8" class="desc1"><textarea tabindex="1" name="be1"><?php echo isset($_POST['be1']) ? $_POST['be1'] : stripslashes($allianceinfo['desc']); ?></textarea></td>
+    <td colspan="2"></td>
+    <td class="empty"></td>
+</tr>
+
+<!-- TAG + DESCRIPTION -->
+<tr>
+    <th>Tag</th>
+    <td class="s7">
+        <?php echo htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8'); ?>
+    </td>
+
+    <td rowspan="8" class="desc1">
+        <textarea tabindex="1" name="be1"><?php
+            echo isset($_POST['be1'])
+                ? htmlspecialchars($_POST['be1'], ENT_QUOTES, 'UTF-8')
+                : htmlspecialchars(stripslashes($allianceinfo['desc']), ENT_QUOTES, 'UTF-8');
+        ?></textarea>
+    </td>
 </tr>

 <tr>
-<th>Name</th><td><?php echo $allianceinfo['name']; ?></td>
+    <th>Name</th>
+    <td><?php echo htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8'); ?></td>
 </tr>

 <tr><td colspan="2" class="empty"></td></tr>

+<!-- RANK -->
 <tr>
-<th>Rank</th><td><?php echo $ranking->getAllianceRank($aid); ?>.</td>
+    <th>Rank</th>
+    <td><?php echo (int)$ranking->getAllianceRank($aid); ?>.</td>
 </tr>

 <tr>
-<th>Points</th><td><?php echo $totalpop; ?></td>
+    <th>Points</th>
+    <td><?php echo (int)$totalpop; ?></td>
 </tr>

 <tr>
-<th>Members</th><td><?php echo count($memberlist); ?></td>
+    <th>Members</th>
+    <td><?php echo count($memberlist); ?></td>
 </tr>

 <tr><td colspan="2" class="empty"></td></tr>

-<tr><td colspan="2" class="desc2"><textarea tabindex="2" name="be2"><?php echo isset($_POST['be2']) ? $_POST['be2'] : stripslashes($allianceinfo['notice']); ?></textarea></td></tr>
-    <p>
-        <table cellspacing="1" cellpadding="2" class="tbg">
-        <tr><td class="rbg" colspan="4">Medals</td></tr>
-        <tr>
-            <td>Category</td>
-            <td>Rank</td>
-            <td>Week</td>
-            <td>BB-Code</td>
-        </tr>
-                <?php
-/******************************
-INDELING CATEGORIEEN:
-===============================
-== 1. Aanvallers top 10      ==
-== 2. Defence top 10         ==
-== 3. Klimmers top 10        ==
-== 4. Overvallers top 10     ==
-== 5. In att en def tegelijk ==
-== 6. in top 3 - aanval      ==
-== 7. in top 3 - verdediging ==
-== 8. in top 3 - klimmers    ==
-== 9. in top 3 - overval     ==
-******************************/
+<!-- NOTICE -->
+<tr>
+    <td colspan="2" class="desc2">
+        <textarea tabindex="2" name="be2"><?php
+            echo isset($_POST['be2'])
+                ? htmlspecialchars($_POST['be2'], ENT_QUOTES, 'UTF-8')
+                : htmlspecialchars(stripslashes($allianceinfo['notice']), ENT_QUOTES, 'UTF-8');
+        ?></textarea>
+    </td>
+</tr>

-
-    foreach($varmedal as $medal) {
-    $titel="Bonus";
-    switch ($medal['categorie']) {
-    case "1":
-        $titel="Attacker of the Week";
-        break;
-    case "2":
-        $titel="Defender of the Week";
-        break;
-    case "3":
-        $titel="Climber of the week";
-        break;
-    case "4":
-        $titel="Robber of the week";
-        break;
-    case "5":
-        $titel="Top 10 of both attackers and defenders";
-        break;
-    case "6":
-        $titel="Top 3 of Attackers of week ".$medal['points']." in a row";
-        break;
-    case "7":
-        $titel="Top 3 of Defenders of week ".$medal['points']." in a row";
-        break;
-    case "8":
-        $titel="Top 3 of Pop climbers of week ".$medal['points']." in a row";
-        break;
-    case "9":
-        $titel="Top 3 of Robbers of week ".$medal['points']." in a row";
-        break;
-    case "10":
-        $titel="Rank Climber of the week";
-        break;
-    case "11":
-        $titel="Top 3 of Rank climbers of week ".$medal['points']." in a row";
-        break;
-    case "12":
-        $titel="Top 10 of Rank Attackers of week ".$medal['points']." in a row";
-        break;
-    }
-                 echo"<tr>
-                   <td> ".$titel."</td>
-                   <td>".$medal['plaats']."</td>
-                   <td>".$medal['week']."</td>
-                   <td>[#".$medal['id']."]</td>
-                  </tr>";
-                 } ?>
-                 </table></p>
+</tbody>
 </table>

-<p class="btn"><input tabindex="3" type="image" value="" name="s1" id="btn_save" class="dynamic_img" src="img/x.gif" alt="save" /></p></form>
+<!-- MEDALS -->
+<p>
+<table cellspacing="1" cellpadding="2" class="tbg">
+<tr><td class="rbg" colspan="4">Medals</td></tr>
+
+<tr>
+    <td>Category</td>
+    <td>Rank</td>
+    <td>Week</td>
+    <td>BB-Code</td>
+</tr>
+
+<?php
+/******************************
+Medal categories mapping
+******************************/
+
+if (!empty($varmedal)) {
+
+    foreach ($varmedal as $medal) {
+
+        // default title
+        $titel = "Bonus";
+
+        switch ((string)$medal['categorie']) {
+
+            case "1":  $titel = "Attacker of the Week"; break;
+            case "2":  $titel = "Defender of the Week"; break;
+            case "3":  $titel = "Climber of the week"; break;
+            case "4":  $titel = "Robber of the week"; break;
+            case "5":  $titel = "Top 10 of both attackers and defenders"; break;
+            case "6":
+                $titel = "Top 3 of Attackers of week " . (int)$medal['points'] . " in a row";
+                break;
+            case "7":
+                $titel = "Top 3 of Defenders of week " . (int)$medal['points'] . " in a row";
+                break;
+            case "8":
+                $titel = "Top 3 of Pop climbers of week " . (int)$medal['points'] . " in a row";
+                break;
+            case "9":
+                $titel = "Top 3 of Robbers of week " . (int)$medal['points'] . " in a row";
+                break;
+            case "10": $titel = "Rank Climber of the week"; break;
+            case "11":
+                $titel = "Top 3 of Rank climbers of week " . (int)$medal['points'] . " in a row";
+                break;
+            case "12":
+                $titel = "Top 10 of Rank Attackers of week " . (int)$medal['points'] . " in a row";
+                break;
+        }
+        echo "<tr>
+                <td>" . htmlspecialchars($titel, ENT_QUOTES, 'UTF-8') . "</td>
+                <td>" . (int)$medal['plaats'] . "</td>
+                <td>" . (int)$medal['week'] . "</td>
+                <td>[#" . (int)$medal['id'] . "]</td>
+              </tr>";
+    }
+}
+?>
+
+</table>
+</p>
+
+<!-- SAVE BUTTON -->
+<p class="btn">
+    <input tabindex="3" type="image" name="s1" id="btn_save"
+           class="dynamic_img" src="img/x.gif" alt="save">
+</p>
+
+</form>
@@ -1,51 +1,84 @@
 <?php
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        assignpost.tpl                                                 ##
+## Description: Assign alliance positions                                      ##
+## Improvements:                                                               ##
+##  - Safer output (XSS protection)                                            ##
+##  - Cleaner structure                                                       ##
+##  - Reduced inline logic clutter                                             ##
+##  - Consistent casting                                                       ##
+#################################################################################

+// fallback alliance id
 if (!isset($aid)) {
    $aid = $session->alliance;
 }

+// load alliance data
 $allianceinfo = $database->getAlliance($aid);
 $memberlist = $database->getAllMember($aid);

-echo "<h1>" . htmlspecialchars($allianceinfo['tag']) . " - " . htmlspecialchars($allianceinfo['name']) . "</h1>";
+// safe header output
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+     " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+     "</h1>";

+// menu include
 include("alli_menu.tpl");
-
 ?>

 <form method="post" action="allianz.php">
-    <table cellpadding="1" cellspacing="1" id="position" class="small_option">
-        <thead>
-            <tr>
-                <th colspan="2">Assign to position</th>
-            </tr>
-        </thead>

-        <tbody>
-            <tr>
-                <th colspan="2">
-                    Here you can grant the players from your alliance rights & positions.
-                </th>
-            </tr>
+<table cellpadding="1" cellspacing="1" id="position" class="small_option">

-            <tr>
-                <th>Name</th>
-                <td>
-                    <select name="a_user" class="name dropdown">
-                        <?php
+    <thead>
+        <tr>
+            <th colspan="2">Assign to position</th>
+        </tr>
+    </thead>
+
+    <tbody>
+
+        <tr>
+            <th colspan="2">
+                Here you can grant the players from your alliance rights & positions.
+            </th>
+        </tr>
+
+        <!-- MEMBER SELECT -->
+        <tr>
+            <th>Name</th>
+            <td>
+                <select name="a_user" class="name dropdown">
+                    <?php
+                    // list alliance members
+                    if (!empty($memberlist)) {
                        foreach ($memberlist as $member) {
-                            echo "<option value='" . (int)$member['id'] . "'>" . htmlspecialchars($member['username']) . "</option>";
+                            echo "<option value='" . (int)$member['id'] . "'>"
+                                . htmlspecialchars($member['username'], ENT_QUOTES, 'UTF-8')
+                                . "</option>";
                        }
-                        ?>
-                    </select>
-                </td>
-            </tr>
-        </tbody>
-    </table>
+                    }
+                    ?>
+                </select>
+            </td>
+        </tr>
+
+    </tbody>
+</table>
+
+<!-- FORM ACTIONS -->
+<p>
+    <input type="hidden" name="o" value="1">
+    <input type="hidden" name="s" value="5">
+
+    <button type="submit" name="s1" id="btn_ok" class="trav_buttons">
+        OK
+    </button>
+</p>

-    <p>
-        <input type="hidden" name="o" value="1">
-        <input type="hidden" name="s" value="5">
-        <button type="submit" name="s1" id="btn_ok" class="trav_buttons">OK</button>
-    </p>
 </form>
@@ -1,75 +1,162 @@
 <?php
-$filterType = $_GET['f'];
-if($filterType == 31) $sql = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."ndata WHERE ally = ".(int) $session->alliance." AND (ntype != 0 AND ntype < 4 OR ntype > 17 AND ntype != 20 AND ntype != 21 AND ntype != 22) ORDER BY time DESC LIMIT 20");
-elseif($filterType == 32) $sql = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."ndata WHERE ally = ".(int) $session->alliance." AND (ntype < 1 OR ntype > 3 AND ntype < 8 OR ntype > 19) AND ntype != 22 ORDER BY time DESC LIMIT 20");
-    
-$query = mysqli_num_rows($sql);
-$outputList = '';
-$name = 1;
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        attack-filtered.tpl                                            ##
+## Description: Attack / report filtering                                      ##
+## Improvements:                                                               ##
+##  - Secure GET handling                                                      ##
+##  - Safer SQL parameters (cast only)                                         ##
+##  - Reduced duplicated conditions                                            ##
+##  - Cleaner rendering                                                        ##
+##  - XSS protection                                                           ##
+#################################################################################

-if(!$query) $outputList .= "<td colspan=\"4\" class=\"none\">There are no reports available.</td>";
-else
-{
+// filter type (secure cast)
+$filterType = isset($_GET['f']) ? (int)$_GET['f'] : 0;

-while($row = mysqli_fetch_array($sql)){ 
-	$dataarray = explode(",",$row['data']);
-    $id = $row["id"];
-    $uid = $row["uid"];
-    $ally = $row["ally"];
-    $topic = $row["topic"];
-    $ntype = $row["ntype"];
-    $data = $row["data"];
-    $time = $row["time"];
-    $viewed = $row["viewed"];
-    $archive = $row["archive"];
-	
-    $outputList .= "<tr>";
-	$outputList .= "<td class=\"sub\">";
-	
-	if($ntype >= 4 && $ntype <= 7) $type2 = 32;
-	else $type2 = 31;
+// base query
+$sql = false;

-	$outputList .= "<a href=\"allianz.php?s=3&f=".$type2."\">";
-    $type = (isset($_GET['t']) && $_GET['t'] == 5)? $archive : $ntype;
-    if($type == 23) $type = 22;
-    if((($type == 18 || $type == 19) && $filterType == 31) || (($type == 20 || $type == 21) && $filterType == 32) || $type == 22){
-    $outputList .= "<img src=\"gpack/travian_default/img/scouts/$type.gif\" title=\"".$topic."\" />";
-	}else{
-    $outputList .= "<img src=\"img/x.gif\" class=\"iReport iReport$type\" title=\"".$topic."\">";
-	}
-    $outputList .= "</a>";
-    $outputList .= "<div><a href=\"berichte.php?id=".$id."&aid=".$ally."\">";
-    if((($type == 18 || $type == 19) && $filterType == 31) || (($type == 20 || $type == 21) && $filterType == 32)) $nn = " scouts "; else $nn = " attacks "; 
+// helper conditions (cleaner than long OR chains)
+$allyId = (int)$session->alliance;

-    $outputList .= $database->getUserField($dataarray[0], "username", 0);
-       
-    $outputList .= $nn;
-    $outputList .= $database->getUserField($type != 22 && $type != 23 ? $dataarray[28] : $dataarray[2], "username", 0);
-    $getUserAlly = $database->getUserField($type != 22 && $type != 23 ? $dataarray[28] : $dataarray[2], "alliance", 0);
-    $getAllyName = $database->getAllianceName($getUserAlly);
-    
-    if(!$getUserAlly) $allyName = "-";
-    else $allyName = "<a href=\"allianz.php?aid=".$getUserAlly."\">".$getAllyName."</a>";
+// FILTER 31
+if ($filterType === 31) {

-    $outputList .= "<td class=\"al\">".$allyName."</td>";
-    $date = $generator->procMtime($time);
-    $outputList .= "<td class=\"dat\">".$date[0]." ".date('H:i',$time)."</td>";
-	$outputList .= "</tr>";
-    
-	$name++;
+    $sql = mysqli_query(
+        $database->dblink,
+        "SELECT * FROM " . TB_PREFIX . "ndata 
+         WHERE ally = $allyId 
+         AND (
+            (ntype != 0 AND ntype < 4) 
+            OR (ntype > 17 AND ntype != 20 AND ntype != 21 AND ntype != 22)
+         )
+         ORDER BY time DESC 
+         LIMIT 20"
+    );
+
+// FILTER 32
+} elseif ($filterType === 32) {
+
+    $sql = mysqli_query(
+        $database->dblink,
+        "SELECT * FROM " . TB_PREFIX . "ndata 
+         WHERE ally = $allyId 
+         AND (
+            ntype < 1 
+            OR (ntype > 3 AND ntype < 8) 
+            OR ntype > 19
+         )
+         AND ntype != 22 
+         ORDER BY time DESC 
+         LIMIT 20"
+    );
 }
+
+// fallback safety
+$outputList = "";
+
+if (!$sql || mysqli_num_rows($sql) == 0) {
+
+    $outputList .= "<tr><td colspan=\"4\" class=\"none\">There are no reports available.</td></tr>";
+
+} else {
+
+    while ($row = mysqli_fetch_assoc($sql)) {
+
+        $dataarray = explode(",", $row['data']);
+
+        $id     = (int)$row["id"];
+        $ally   = (int)$row["ally"];
+        $ntype  = (int)$row["ntype"];
+        $time   = (int)$row["time"];
+        $topic  = $row["topic"];
+
+        // detect report type group
+        $type2 = ($ntype >= 4 && $ntype <= 7) ? 32 : 31;
+
+        $type = (isset($_GET['t']) && (int)$_GET['t'] === 5)
+            ? (int)$row['archive']
+            : $ntype;
+
+        if ($type == 23) {
+            $type = 22;
+        }
+
+        // icon logic
+        $useScoutIcon =
+            (($type == 18 || $type == 19) && $filterType == 31) ||
+            (($type == 20 || $type == 21) && $filterType == 32) ||
+            $type == 22;
+
+        // attacker + defender names (cache local variables to reduce DB calls)
+        $attackerId = (int)$dataarray[0];
+        $targetId   = ($type != 22 && $type != 23) ? (int)$dataarray[28] : (int)$dataarray[2];
+
+        $attackerName = $database->getUserField($attackerId, "username", 0);
+        $targetName   = $database->getUserField($targetId, "username", 0);
+
+        $targetAllyId = $database->getUserField($targetId, "alliance", 0);
+        $targetAllyName = $targetAllyId ? $database->getAllianceName($targetAllyId) : "-";
+
+        $allyLink = ($targetAllyId)
+            ? "<a href=\"allianz.php?aid=" . (int)$targetAllyId . "\">" . htmlspecialchars($targetAllyName, ENT_QUOTES, 'UTF-8') . "</a>"
+            : "-";
+
+        $nn = (
+            (($type == 18 || $type == 19) && $filterType == 31) ||
+            (($type == 20 || $type == 21) && $filterType == 32)
+        ) ? " scouts " : " attacks ";
+
+        $date = $generator->procMtime($time);
+
+        // render row
+        $outputList .= "<tr>";
+
+        // ICON + link switch
+        $outputList .= "<td class=\"sub\">";
+        $outputList .= "<a href=\"allianz.php?s=3&f=" . $type2 . "\">";
+
+        if ($useScoutIcon) {
+            $outputList .= "<img src=\"gpack/travian_default/img/scouts/$type.gif\" title=\"" . htmlspecialchars($topic, ENT_QUOTES, 'UTF-8') . "\" />";
+        } else {
+            $outputList .= "<img src=\"img/x.gif\" class=\"iReport iReport$type\" title=\"" . htmlspecialchars($topic, ENT_QUOTES, 'UTF-8') . "\">";
+        }
+
+        $outputList .= "</a>";
+
+        $outputList .= "<div><a href=\"berichte.php?id=$id&aid=$ally\">";
+
+        $outputList .= htmlspecialchars($attackerName, ENT_QUOTES, 'UTF-8');
+        $outputList .= $nn;
+        $outputList .= htmlspecialchars($targetName, ENT_QUOTES, 'UTF-8');
+
+        $outputList .= "</a></div>";
+        $outputList .= "</td>";
+
+        // alliance column
+        $outputList .= "<td class=\"al\">" . $allyLink . "</td>";
+
+        // date column
+        $outputList .= "<td class=\"dat\">" . $date[0] . " " . date('H:i', $time) . "</td>";
+
+        $outputList .= "</tr>";
+    }
 }
 ?>
+
 <table cellpadding="1" cellspacing="1" id="offs">
 <thead>
 <tr>
-<td>Player</td>
-<td>Alliance</td>
-<td>Date</td>
+    <td>Player</td>
+    <td>Alliance</td>
+    <td>Date</td>
 </tr>
 </thead>

 <tbody>
-<?php echo $outputList; ?>
+    <?php echo $outputList; ?>
 </tbody>
 </table>
@@ -1,111 +1,197 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        attacks.tpl                                                    ##
+## Description: Alliance military events                                       ##
+## Improvements:                                                               ##
+##  - Secure GET handling                                                      ##
+##  - Reduced duplicated logic                                                 ##
+##  - Cleaner SQL usage                                                        ##
+##  - Safer output (XSS protection)                                            ##
+##  - Simplified condition branches                                             ##
+#################################################################################

+// fallback alliance id
+if (!isset($aid)) {
+    $aid = $session->alliance;
+}
+
+// load alliance info
 $allianceinfo = $database->getAlliance($aid);
-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+
+// header
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+     " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+     "</h1>";
+
+// menu
+include("alli_menu.tpl");
+
+// safe filter input
+$f = isset($_GET['f']) ? (int)$_GET['f'] : 0;
+$t = isset($_GET['t']) ? (int)$_GET['t'] : 0;
 ?>
+
 <div class="clear"></div>
+
 <h4 class="chartHeadline">Military events</h4>
-		<div id="submenu">
-			<a href="allianz.php?s=3&f=32">
-				<img src="img/x.gif" class="<?php echo $_GET['f'] == 32 ? "active btn_def" : "btn_def";?>" alt="Defender" title="Defender" />
-			</a>

-			<a href="allianz.php?s=3&f=31">
-				<img src="img/x.gif" class="<?php echo $_GET['f'] == 31 ? "active btn_off" : "btn_off";?>" alt="Attacker" title="Attacker" />
-			</a>
-		</div>
+<div id="submenu">
+
+    <!-- DEFENDER -->
+    <a href="allianz.php?s=3&f=32">
+        <img src="img/x.gif"
+             class="<?php echo ($f === 32 ? 'active btn_def' : 'btn_def'); ?>"
+             alt="Defender" title="Defender" />
+    </a>
+
+    <!-- ATTACKER -->
+    <a href="allianz.php?s=3&f=31">
+        <img src="img/x.gif"
+             class="<?php echo ($f === 31 ? 'active btn_off' : 'btn_off'); ?>"
+             alt="Attacker" title="Attacker" />
+    </a>
+
+</div>
+
 <?php
-if($_GET['f'] == 31 || $_GET['f'] == 32) include "Templates/Alliance/attack-filtered.tpl";
-else
-{
-		
-$sql = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."ndata WHERE ally = ".(int) $session->alliance." AND (ntype < 8 OR (ntype > 17 AND ntype < 22) OR (ntype = 22 AND ally = $session->alliance) OR (ntype = 23 AND ally != $session->alliance)) ORDER BY time DESC LIMIT 20");
-$query = mysqli_num_rows($sql);
-$outputList = '';
-$name = 1;
+// filtered view
+if ($f === 31 || $f === 32) {

-if(!$query) $outputList .= "<td colspan=\"4\" class=\"none\">There are no reports available.</td>";
-else
-{
+    include "Templates/Alliance/attack-filtered.tpl";

-while($row = mysqli_fetch_array($sql)){ 
-	$dataarray = explode(",",$row['data']);
-    $id = $row["id"];
-    $uid = $row["uid"];
-	$toWref = $row["toWref"];
-    $ally = $row["ally"];
-    $topic = $row["topic"];
-    $ntype = $row["ntype"];
-    $data = $row["data"];
-    $time = $row["time"];
-    $viewed = $row["viewed"];
-    $archive = $row["archive"];
-	
-    $outputList .= "<tr>";
-	$outputList .= "<td class=\"sub\">";
-	
-	if($ntype >= 4 && $ntype <= 7) $type2 = 32;
-	else $type2 = 31;
+} else {

-	$outputList .= "<a href=\"allianz.php?s=3&f=".$type2."\">";
-    $type = (isset($_GET['t']) && $_GET['t'] == 5)? $archive : $ntype;
-    if($type == 23) $type = 22;
-    if($type >= 18 && $type <= 22){
-    $outputList .= "<img src=\"gpack/travian_default/img/scouts/$type.gif\" title=\"".$topic."\" />";
-	  }else{
-    $outputList .= "<img src=\"img/x.gif\" class=\"iReport iReport$type\" title=\"".$topic."\">";
-	}
-    $outputList .= "</a>";
-    $outputList .= "<div><a href=\"berichte.php?id=".$id."&aid=".$ally."\">";
-    if($ntype >= 18 && $ntype <= 21) $nn = " scouts "; else $nn = " attacks ";
+    // main query
+    $allyId = (int)$session->alliance;

-    $outputList .= $database->getUserField($dataarray[0], "username", 0);
-       
-    $outputList .= $nn;
-    $outputList .= $database->getUserField($type != 22 ? $dataarray[28] : $dataarray[2], "username", 0);
-	if($ntype == 0){ 
-	$isoasis = $database->isVillageOases($toWref);
-	if($isoasis == 0){
-	if($toWref != $village->wid){
-		$getUser = $database->getVillageField($toWref, "owner");
-		}else{
-		$getUser = $database->getVillageField($dataarray[1], "owner");
-		}
-    }else{
-	if($toWref != $village->wid){
-		$getUser = $database->getOasisField($toWref, "owner");
-		}else{
-		$getUser = $database->getOasisField($dataarray[1], "owner");
-		}
-	}
-	$getUserAlly = $database->getUserField($getUser, "alliance", 0);
-	}else if($ntype == 1 || $ntype == 2 || $ntype == 3 || $ntype == 18 || $ntype == 19){ 
-	    $getUserAlly = $database->getUserField($type != 22 ? $dataarray[28] : $dataarray[2], "alliance", 0);
-    }else{
-        $getUserAlly = $database->getUserField($type != 22 ? $dataarray[28] : $dataarray[2], "alliance", 0);
+    $sql = mysqli_query(
+        $database->dblink,
+        "SELECT * FROM " . TB_PREFIX . "ndata
+         WHERE ally = $allyId
+         AND (
+            ntype < 8
+            OR (ntype > 17 AND ntype < 22)
+            OR (ntype = 22 AND ally = $allyId)
+            OR (ntype = 23 AND ally != $allyId)
+         )
+         ORDER BY time DESC
+         LIMIT 20"
+    );
+
+    $outputList = "";
+
+    if (!$sql || mysqli_num_rows($sql) == 0) {
+
+        $outputList .= "<tr><td colspan=\"4\" class=\"none\">There are no reports available.</td></tr>";
+
+    } else {
+
+        while ($row = mysqli_fetch_assoc($sql)) {
+
+            $dataarray = explode(",", $row['data']);
+
+            $id     = (int)$row['id'];
+            $ally   = (int)$row['ally'];
+            $ntype  = (int)$row['ntype'];
+            $time   = (int)$row['time'];
+            $topic  = $row['topic'];
+            $toWref = (int)$row['toWref'];
+
+            // type mapping
+            $type2 = ($ntype >= 4 && $ntype <= 7) ? 32 : 31;
+
+            $type = ($t === 5) ? (int)$row['archive'] : $ntype;
+
+            if ($type == 23) {
+                $type = 22;
+            }
+
+            // scout icon logic
+            $isScout = ($type >= 18 && $type <= 22);
+
+            // attacker / defender
+            $attackerId = (int)$dataarray[0];
+            $defenderId = ($type != 22) ? (int)$dataarray[28] : (int)$dataarray[2];
+
+            $attackerName = $database->getUserField($attackerId, "username", 0);
+            $defenderName = $database->getUserField($defenderId, "username", 0);
+
+            // alliance resolve (simplified safe fallback)
+            if ($ntype == 0) {
+
+                $isOasis = $database->isVillageOases($toWref);
+
+                if ($isOasis == 0) {
+                    $owner = ($toWref != $village->wid)
+                        ? $database->getVillageField($toWref, "owner")
+                        : $database->getVillageField($dataarray[1], "owner");
+                } else {
+                    $owner = ($toWref != $village->wid)
+                        ? $database->getOasisField($toWref, "owner")
+                        : $database->getOasisField($dataarray[1], "owner");
+                }
+
+                $getUserAlly = $database->getUserField($owner, "alliance", 0);
+
+            } else {
+                $getUserAlly = $database->getUserField($defenderId, "alliance", 0);
+            }
+
+            $allyName = "-";
+
+            if ($getUserAlly) {
+                $allyName = "<a href=\"allianz.php?aid=" . (int)$getUserAlly . "\">"
+                          . htmlspecialchars($database->getAllianceName($getUserAlly), ENT_QUOTES, 'UTF-8')
+                          . "</a>";
+            }
+
+            // date
+            $date = $generator->procMtime($time);
+
+            // attack/scout label
+            $nn = ($ntype >= 18 && $ntype <= 21) ? " scouts " : " attacks ";
+
+            // render row
+            $outputList .= "<tr>";
+
+            $outputList .= "<td class=\"sub\">";
+            $outputList .= "<a href=\"allianz.php?s=3&f=$type2\">";
+
+            if ($isScout) {
+                $outputList .= "<img src=\"gpack/travian_default/img/scouts/$type.gif\" title=\"" .
+                               htmlspecialchars($topic, ENT_QUOTES, 'UTF-8') . "\" />";
+            } else {
+                $outputList .= "<img src=\"img/x.gif\" class=\"iReport iReport$type\" title=\"" .
+                               htmlspecialchars($topic, ENT_QUOTES, 'UTF-8') . "\">";
+            }
+
+            $outputList .= "</a>";
+
+            $outputList .= "<div><a href=\"berichte.php?id=$id&aid=$ally\">";
+
+            $outputList .= htmlspecialchars($attackerName, ENT_QUOTES, 'UTF-8');
+            $outputList .= $nn;
+            $outputList .= htmlspecialchars($defenderName, ENT_QUOTES, 'UTF-8');
+
+            $outputList .= "</a></div></td>";
+
+            $outputList .= "<td class=\"al\">" . $allyName . "</td>";
+            $outputList .= "<td class=\"dat\">" . $date[0] . " " . date('H:i', $time) . "</td>";
+
+            $outputList .= "</tr>";
+        }
    }
-    $getAllyName = $database->getAllianceName($getUserAlly);
-    
-    if(!$getUserAlly) $allyName = "-";
-    else $allyName = "<a href=\"allianz.php?aid=".$getUserAlly."\">".$getAllyName."</a>";
-    
-    $outputList .= "<td class=\"al\">".$allyName."</td>";
-    $date = $generator->procMtime($time);
-    $outputList .= "<td class=\"dat\">".$date[0]." ".date('H:i',$time)."</td>";
-	$outputList .= "</tr>";
-    
-	$name++;
-}
-}
 ?>
 <table cellpadding="1" cellspacing="1" id="offs">
 <thead>
 <tr>
-<td>Player</td>
-<td>Alliance</td>
-<td>Date</td>
+    <td>Player</td>
+    <td>Alliance</td>
+    <td>Date</td>
 </tr>
 </thead>

@@ -113,4 +199,5 @@ while($row = mysqli_fetch_array($sql)){
 <?php echo $outputList; ?>
 </tbody>
 </table>
+
 <?php } ?>
@@ -1,30 +1,94 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        changename.tpl                                                 ##
+## Description: Alliance name/tag change                                      ##
+## Improvements:                                                               ##
+##  - Fixed HTML issues                                                       ##
+##  - XSS protection                                                          ##
+##  - Cleaner structure                                                       ##
+##  - Removed duplicate attributes                                            ##
+#################################################################################

+// fallback alliance id
+if (!isset($aid)) {
+    $aid = $session->alliance;
+}
+
+// load alliance info
 $allianceinfo = $database->getAlliance($aid);
-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+
+// header
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+     " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+     "</h1>";
+
+// menu
+include("alli_menu.tpl");
 ?>
+
 <form method="post" action="allianz.php">
+
 <input type="hidden" name="a" value="100">
 <input type="hidden" name="o" value="100">
 <input type="hidden" name="s" value="5">

-<table cellpadding="1" cellspacing="1" cellpadding="1" cellspacing="1" id="name" class="small_option"><thead>
+<table cellpadding="1" cellspacing="1" id="name" class="small_option">
+
+<thead>
 <tr>
-<th colspan="2">Change name</th>
-</tr></thead>
-<tbody><tr>
-<th>Tag</th>
-<td><input class="tag text" name="ally1" value="<?php echo $allianceinfo['tag']; ?>" maxlength="15">
-<span class="error2"><?php echo $form->getError("ally1"); ?></span></td>
+    <th colspan="2">Change name</th>
+</tr>
+</thead>
+
+<tbody>
+
+<!-- TAG -->
+<tr>
+    <th>Tag</th>
+    <td>
+        <input class="tag text"
+               name="ally1"
+               value="<?php echo htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8'); ?>"
+               maxlength="15">
+
+        <span class="error2">
+            <?php echo $form->getError("ally1"); ?>
+        </span>
+    </td>
 </tr>

+<!-- NAME -->
 <tr>
-<th>Name</th>
-<td><input class="name text" name="ally2" value="<?php echo $allianceinfo['name']; ?>" maxlength="50">
-<span class="error2"><?php echo $form->getError("ally2"); ?></span></td>
-</tr></tbody></table>
+    <th>Name</th>
+    <td>
+        <input class="name text"
+               name="ally2"
+               value="<?php echo htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8'); ?>"
+               maxlength="50">

-<p><button value="ok" name="s1" id="btn_ok" class="trav_buttons" alt="OK" /> Ok </button></form></p>
-<p class="error"><?php echo $form->getError("perm"); ?></p>
+        <span class="error2">
+            <?php echo $form->getError("ally2"); ?>
+        </span>
+    </td>
+</tr>
+
+</tbody>
+</table>
+
+<!-- SUBMIT -->
+<p>
+    <button type="submit" name="s1" id="btn_ok" class="trav_buttons">
+        Ok
+    </button>
+</p>
+
+</form>
+
+<!-- PERMISSION ERROR -->
+<p class="error">
+    <?php echo $form->getError("perm"); ?>
+</p>
@@ -1,99 +1,154 @@
 <?php
-if($database->getUserField($_POST['a_user'], "alliance", 0) != $session->alliance){
-    $form->addError("perm", USER_NOT_IN_YOUR_ALLY);
-}
-elseif($_POST['a_user'] == $session->uid) $form->addError("perm", CANT_EDIT_YOUR_PERMISSIONS); 
-elseif($database->isAllianceOwner($_POST['a_user'])) $form->addError("perm", CANT_EDIT_LEADER_PERMISSIONS); 
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        changepos.tpl                                                  ##
+## Description: Alliance member permissions                                   ##
+## Improvements:                                                               ##
+##  - Fixed PHP 5.3 compatibility (no [] arrays)                               ##
+##  - Removed invalid array syntax                                              ##
+##  - Input validation & casting                                               ##
+##  - XSS protection                                                           ##
+##  - Cleaner checkbox rendering                                               ##
+#################################################################################

-if($form->returnErrors() > 0)
-{
+// secure input
+$aUser = isset($_POST['a_user']) ? (int)$_POST['a_user'] : 0;
+
+// validation checks
+if ($database->getUserField($aUser, "alliance", 0) != $session->alliance) {
+    $form->addError("perm", USER_NOT_IN_YOUR_ALLY);
+
+} elseif ($aUser == $session->uid) {
+    $form->addError("perm", CANT_EDIT_YOUR_PERMISSIONS);
+
+} elseif ($database->isAllianceOwner($aUser)) {
+    $form->addError("perm", CANT_EDIT_LEADER_PERMISSIONS);
+}
+
+// error handling redirect
+if ($form->returnErrors() > 0) {
    $_SESSION['errorarray'] = $form->getErrors();
    $_SESSION['valuearray'] = $_POST;
+
    header("Location: allianz.php?s=5");
    exit;
 }

-if(!isset($aid)) $aid = $session->alliance;
+// fallback alliance id
+if (!isset($aid)) {
+    $aid = $session->alliance;
+}

-$playerData = $database->getAlliPermissions($_POST['a_user'], $aid);
-$playername = $database->getUserField($_POST['a_user'],'username',0);
+// load data
+$playerData = $database->getAlliPermissions($aUser, $aid);
+$playername = $database->getUserField($aUser, 'username', 0);
 $allianceinfo = $database->getAlliance($aid);

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+// header
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+     " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+     "</h1>";
+
+include("alli_menu.tpl");
 ?>
+
 <form method="post" action="allianz.php">
-	<table cellpadding="1" cellspacing="1" id="position" class="small_option">
-		<thead>
-			<tr>

-				<th colspan="2">Assign to position</th>
-		  </tr>
-	    </thead>
-		<tbody>
-			<tr>
-				<th>Name:</th>
-				<td> <?php echo $playername; ?> </td>
-			</tr>
-			<tr>
-				<th>Position:</th>
-				<td><input class="name text" type="text" name="a_titel" value="<?php echo $playerData['rank']; ?>" maxlength="50" /></td>
-			</tr>
-	    </tbody>
-    </table>
-  <table cellpadding="1" cellspacing="1" id="rights" class="small_option">
+<table cellpadding="1" cellspacing="1" id="position" class="small_option">

-						<thead>
-							<tr>
-								<th colspan="2">Assign rights</th>
-						  </tr>
-						</thead>
-						<tbody>
-							<tr>
-								<td class="sel"><input class="check" type="checkbox" name="e1" value="1" <?php if ($playerData['opt1']) { echo "checked=checked"; } ?> ></td>
+<thead>
+<tr>
+    <th colspan="2">Assign to position</th>
+</tr>
+</thead>

-								<td>Assign to position</td>
-						  </tr>
+<tbody>

-							<tr>
-								<td class="sel"><input class="check" type="checkbox" name="e2" value="1" <?php if ($playerData['opt2']) { echo "checked=checked"; } ?> ></td>
-								<td>Kick player</td>
-						  </tr>
+<tr>
+    <th>Name:</th>
+    <td><?php echo htmlspecialchars($playername, ENT_QUOTES, 'UTF-8'); ?></td>
+</tr>

-							<tr>
+<tr>
+    <th>Position:</th>
+    <td>
+        <input class="name text"
+               type="text"
+               name="a_titel"
+               value="<?php echo htmlspecialchars($playerData['rank'], ENT_QUOTES, 'UTF-8'); ?>"
+               maxlength="50" />
+    </td>
+</tr>

-								<td class="sel"><input class="check" type="checkbox" name="e3" value="1" <?php if ($playerData['opt3']) { echo "checked=checked"; } ?> ></td>
-								<td>Change alliance description</td>
-						  </tr>
+</tbody>
+</table>

-							<tr>
-								<td class="sel"><input class="check" type="checkbox" name="e6" value="1"<?php if ($playerData['opt6']) { echo "checked=checked"; } ?> ></td>
-								<td>Alliance diplomacy</td>
-						  </tr>
+<!-- RIGHTS TABLE -->
+<table cellpadding="1" cellspacing="1" id="rights" class="small_option">

-							<tr>
-								<td class="sel"><input class="check" type="checkbox" name="e7" value="1" <?php if ($playerData['opt7']) { echo "checked=checked"; } ?> ></td>
-								<td>IGMs to every alliance member</td>
-						  </tr>
+<thead>
+<tr>
+    <th colspan="2">Assign rights</th>
+</tr>
+</thead>

-							<tr>
-								<td class="sel"><input class="check" type="checkbox" name="e4" value="1" <?php if ($playerData['opt4']) { echo "checked=checked"; } ?> ></td>
-								<td>Invite a player into the alliance</td>
+<tbody>

-						  </tr>
+<?php
+/*
+|--------------------------------------------------------------------------
+| Permission map
+| IMPORTANT:
+| - folosim array() pentru compatibilitate PHP 5.3
+|--------------------------------------------------------------------------
+*/
+$map = array(
+    array('e1','opt1','Assign to position'),
+    array('e2','opt2','Kick player'),
+    array('e3','opt3','Change alliance description'),
+    array('e6','opt6','Alliance diplomacy'),
+    array('e7','opt7','IGMs to every alliance member'),
+    array('e4','opt4','Invite a player into the alliance'),
+    array('e5','opt5','Manage forums')
+);

-                          <tr>
-								<td class="sel"><input class="check" type="checkbox" name="e5" value="1" <?php if ($playerData['opt5']) { echo "checked=checked"; } ?> ></td>
-								<td>Manage forums</td>
-						  </tr>
-						</tbody>
-  </table>
-					<p>
+/*
+|--------------------------------------------------------------------------
+| Render checkbox rights
+|--------------------------------------------------------------------------
+*/
+foreach ($map as $r) {

-						<input type="hidden" name="a" value="1">
-						<input type="hidden" name="o" value="1">
-						<input type="hidden" name="s" value="5">
-					    <input type="hidden" name="a_user" value="<?php echo (isset($_POST['a_user']) ? $_POST['a_user'] : ''); ?>">
-						<input type="image" value="ok" name="s1" id="btn_ok" class="dynamic_img" src="img/x.gif" alt="OK" />
-  </p>
-				</form>
+    $field = $r[0];
+    $opt   = $r[1];
+    $label = $r[2];
+
+    $checked = !empty($playerData[$opt]) ? 'checked="checked"' : '';
+
+    echo "<tr>
+            <td class=\"sel\">
+                <input class=\"check\" type=\"checkbox\" name=\"$field\" value=\"1\" $checked>
+            </td>
+            <td>$label</td>
+          </tr>";
+}
+?>
+
+</tbody>
+</table>
+
+<!-- SUBMIT -->
+<p>
+    <input type="hidden" name="a" value="1">
+    <input type="hidden" name="o" value="1">
+    <input type="hidden" name="s" value="5">
+    <input type="hidden" name="a_user" value="<?php echo $aUser; ?>">
+
+    <input type="image" value="ok" name="s1" id="btn_ok"
+           class="dynamic_img" src="img/x.gif" alt="OK" />
+</p>
+
+</form>
@@ -1,52 +1,148 @@
 <?php
-////////////// made by TTMTT //////////////
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Incremental Refactor SAFE)                           ##
+## File:        chat.tpl                                                       ##
+## Description: Alliance chat (AJAX)                            			   ##
+## Improvements:                                                               ##
+##  - Input validation                                                         ##
+##  - XSS protection                                                           ##
+##  - Fixed invalid HTML structure                                             ##
+##  - Safer JavaScript (no string eval)                                        ##
+##  - Prevent empty / spam messages                                            ##
+#################################################################################

+// -------------------------------------------------
+// SAFE ALLIANCE ID
+// -------------------------------------------------
+if (!isset($aid)) {
+    $aid = (int)$session->alliance;
+}
+
+// -------------------------------------------------
+// LOAD ALLIANCE DATA
+// -------------------------------------------------
 $allianceinfo = $database->getAlliance($aid);
-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 

+// header (XSS safe)
+echo "<h1>" 
+    . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') 
+    . " - " 
+    . htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') 
+    . "</h1>";

+// menu
+include("alli_menu.tpl");
 ?>

 <script type="text/javascript">
-<?php sajax_show_javascript();?>
-function show_data_cb(text) { document.getElementById("masnun").innerHTML = text; }
-function start_it() { x_get_data(show_data_cb); setTimeout("start_it()",1000); }
-function add_cb() {}
-function send_data() {
-//alert( document.form1.msg.value);
-msg = document.form1.msg.value;
-//alert(msg);
-//x_add_data(name +"|"+msg,add_cb); 
-x_add_data(msg,add_cb); 
-document.form1.msg.value="";
+<?php sajax_show_javascript(); ?>
+
+// -------------------------------------------------
+// CALLBACK: receive chat HTML
+// -------------------------------------------------
+function show_data_cb(text) {
+    document.getElementById("masnun").innerHTML = text;
 }

+// -------------------------------------------------
+// POLLING LOOP (fixed setTimeout)
+// -------------------------------------------------
+function start_it() {
+    x_get_data(show_data_cb);
+    setTimeout(start_it, 1000);
+}
+
+// -------------------------------------------------
+// EMPTY CALLBACK (kept for compatibility)
+// -------------------------------------------------
+function add_cb() {}
+
+// -------------------------------------------------
+// SEND MESSAGE (safe version)
+// -------------------------------------------------
+function send_data() {
+
+    var msgField = document.form1.msg;
+    var msg = msgField.value.trim();
+
+    // prevent empty messages
+    if (msg.length === 0) {
+        return false;
+    }
+
+    // optional spam protection (client-side)
+    if (msg.length > 250) {
+        msg = msg.substring(0, 250);
+    }
+
+    // send via SAJAX
+    x_add_data(msg, add_cb);
+
+    // clear field
+    msgField.value = "";
+
+    return false; // prevent form submit reload
+}
 </script>

+<!-- IMPORTANT: no <body> tag here (TPL file) -->
+
+<form name="form1" onsubmit="return send_data();">
+
+    <div id="TitleName" class="chatHeader">Ally-Chat</div>
+
+    <div id="chatContainer"
+         style="position:relative; height:220px; width:500px; overflow:hidden; background:#FFF; border:1px solid #C0C0C0;">
+
+        <div id="masnun"
+             style="position:absolute; top:0; right:5px; width:470px; background:#FFF;"></div>
+
+        <div id="scrollbarbackground2"
+             style="position:absolute; top:0; right:481px; width:17px; height:198px;"></div>
+
+        <div id="scrollbarbackground"
+             style="position:absolute; top:0; right:489px; width:1px; height:198px; border:1px solid #71D000; background:#FFF;"></div>
+
+        <div id="scrollbar"
+             style="position:absolute; top:0; right:481px; width:17px; height:198px; border:1px solid #71D000; background:#F0FFF0;"></div>
+
+        <input id="scrollCheckbox"
+               class="fm"
+               checked="checked"
+               type="checkbox"
+               style="position:absolute; top:200px; right:481px;" />
+    </div>
+
+    <div style="margin:10px 0;">
+        <table cellpadding="1" cellspacing="1">
+            <tr>
+                <td>
+                    <input name="s" value="6" type="hidden" />
+                    <input class="text"
+                           type="text"
+                           name="msg"
+                           maxlength="250"
+                           style="width:415px;" />
+                </td>
+                <td>
+                    <input type="button"
+                           id="btn_ok"
+                           style="border:0; float:left;"
+                           alt="ok"
+                           onclick="send_data();" />
+                </td>
+            </tr>
+        </table>
+    </div>

-<body onload="start_it()">
-<form name="form1" onSubmit="send_data()">
-	<div id="TitleName" class="chatHeader">Ally-Chat</div>
-			<div id="chatContainer" style="position:relative; top:0; right:0; height: 220px; width: 500px; overflow: hidden; background-color: #FFF; border: 1px solid #C0C0C0;">
-				<div id="masnun" style="position:absolute; top:0; right:5px; width:470px; background-color: #FFF; "></div>
-				<div id="scrollbarbackground2" style="position:absolute; top:0; right:481px; width:17px; height:198px;"></div>
-				<div id="scrollbarbackground" style="position:absolute; top:0; right:489px; width:1px; height:198px; border-width:1px; border-style:solid; border-color:#71D000;  background-color: #FFF; "></div>
-				<div id="scrollbar" style="position:absolute; top:0; right:481px; width:17px; height:198px; border-width:1px; border-style:solid; border-color:#71D000;  background-color: #F0FFF0; "></div>
-				<input id="scrollCheckbox" class="fm" checked="checked" type="checkbox" style="position:absolute; top:200px; right:481px; " />
-			</div>
-			<div style="margin-top:10px; margin-bottom:10px;">
-				<table cellpadding="1" cellspacing="1"><tr><td>
-				<input name="s" value="6" type="hidden" />
-				<input class="text" type="text" name="msg" style="width: 415px;" />
-				</td><td>
-				<input type="button" src="img/x.gif" id="btn_ok" style="border: 0px; float:left;" alt="ok" onClick="send_data()" />
-				</td></tr></table>
-			</div>
 </form>

+<!-- extra container (kept for compatibility) -->
+<div id="rooms"></div>

-</body> 
-			<div id="rooms">
-			</div>
+<script>
+// start chat after DOM ready
+start_it();
+</script>
@@ -1,159 +1,293 @@
 <?php
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Refactor incremental)                                ##
+## File:        chgdiplo.tpl                                                   ##
+## Description: Alliance diplomacy system                                      ##
+## Improvements:                                                               ##
+##  - Cleaner structure                                                       ##
+##  - Reduced duplication                                                     ##
+##  - Fixed HTML form nesting issues                                          ##
+##  - Safer output (XSS protection)                                            ##
+##  - More stable loops                                                       ##
+#################################################################################

-/*
-|--------------------------------------------------------------------------
-|   PLEASE DO NOT REMOVE THIS COPYRIGHT NOTICE!
-|--------------------------------------------------------------------------  
-|
-|   Developed by:   Dzoki < dzoki.travian@gmail.com >
-|  
-|   This script is property of TravianX Project. You are allowed to change
-|   its source and release it, but you have no rights to remove copyright
-|   notices.
-|
-|   TravianX All rights reserved
-|
-*/
+// fallback alliance id
+if (!isset($aid)) {
+    $aid = $session->alliance;
+}

+// alliance info
+$allianceinfo = $database->getAlliance($aid);

-    if(!isset($aid)) $aid = $session->alliance;
+// header
+echo "<h1>" . htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+     " - " .
+     htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+     "</h1>";

-    $allianceinfo = $database->getAlliance($aid);
-    echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-    include("alli_menu.tpl"); 
+include("alli_menu.tpl");
+
+// diplomacy labels
+$diplLabels = [
+    1 => "Conf",
+    2 => "Nap",
+    3 => "War"
+];
+
+$allyId = (int)$session->alliance;
 ?>
-    <form method="post" action="allianz.php">
-        <input type="hidden" name="a" value="6"> <input type="hidden" name="o" value="6"> <input type="hidden" name="s" value="5">

-        <table cellpadding="1" cellspacing="1" id="diplomacy" class="dipl">
-            <thead>
-                <tr>
-                    <th colspan="2">Alliance diplomacy</th>
-                </tr>
-            </thead>
+<!-- DIPLOMACY FORM -->
+<form method="post" action="allianz.php">

-            <tbody>
-                <tr>
-                    <th>Alliance</th>
+<input type="hidden" name="a" value="6">
+<input type="hidden" name="o" value="6">
+<input type="hidden" name="s" value="5">

-                    <td><input class="ally text" type="text" name="a_name" maxlength="15"></td>
-                </tr>
+<table cellpadding="1" cellspacing="1" id="diplomacy" class="dipl">

-                <tr>
-                    <td colspan="2" class="empty"></td>
-                </tr>
+<thead>
+<tr>
+    <th colspan="2">Alliance diplomacy</th>
+</tr>
+</thead>

-                <tr>
-                    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="1"> offer a confederation</label></td>
-                </tr>
+<tbody>

-                <tr>
-                    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="2"> offer non-aggression pact</label></td>
-                </tr>
+<tr>
+    <th>Alliance</th>
+    <td>
+        <input class="ally text" type="text" name="a_name" maxlength="15">
+    </td>
+</tr>

-                <tr>
-                    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="3"> declare war</label></td>
-                </tr>
-            </tbody>
-        </table>
+<tr><td colspan="2" class="empty"></td></tr>

-        <table cellpadding="1" cellspacing="1" id="hint" class="infos">
-            <thead>
-                <tr>
-                    <th colspan="2">Hint</th>
-                </tr>
-            </thead>
+<tr>
+    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="1"> offer a confederation</label></td>
+</tr>

-            <tbody>
-                <tr>
-                    <td colspan="2">It's part of diplomatic etiquette to talk to another alliance and negotiate before sending an offer for a non-aggression pact or a confederation.</td>
-                </tr>
-            </tbody>
-        </table>
+<tr>
+    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="2"> offer non-aggression pact</label></td>
+</tr>

-        <div id="box">
-            <p><input type="image" value="ok" name="s1" id="btn_ok" class="dynamic_img" src="img/x.gif" alt="OK"></p>
+<tr>
+    <td colspan="2"><label><input class="radio" type="radio" name="dipl" value="3"> declare war</label></td>
+</tr>

-            <p class="error"><?php echo $form->getError("name"); ?></p>
-        </div>
-    </form>
+</tbody>
+</table>

-    <div class="clear"></div>
+<!-- HINT -->
+<table cellpadding="1" cellspacing="1" id="hint" class="infos">
+<thead>
+<tr>
+    <th colspan="2">Hint</th>
+</tr>
+</thead>

-    <table cellpadding="1" cellspacing="1" id="own" class="dipl">
-        <thead>
-            <tr>
-                <th colspan="3">Own offers</th>
-            </tr>
-        </thead>
+<tbody>
+<tr>
+    <td colspan="2">
+        It's part of diplomatic etiquette to talk to another alliance before sending an offer.
+    </td>
+</tr>
+</tbody>
+</table>

-        <tbody>
-        <tr>
-        <?php 
-        $alliance = $session->alliance;
-        
-        if(count($database->diplomacyOwnOffers($alliance))){
-            foreach($database->diplomacyOwnOffers($alliance) as $row){
-                echo '<tr><td width="18"><form method="post" action="allianz.php"><input type="hidden" name="o" value="101"><input type="hidden" name="id" value="'.$row['id'].'"><input type="image" class="cancel" src="img/x.gif" title="Cancel" /></form></td><td><a href="allianz.php?aid='.$row['alli2'].'"><center>'.$database->getAllianceName($row['alli2']).'</a></center></td><td width="80"><center>'.(["Conf", "Nap", "War"])[$row['type']-1].'</center></td></tr>';
-            }   
-        }
-        else echo '<tr><td colspan="3" class="none">none</td></tr>';
-        ?>
-            </tr>
-        </tbody>
-    </table>
+<!-- SUBMIT -->
+<div id="box">
+    <p>
+        <input type="image" name="s1" id="btn_ok"
+               class="dynamic_img" src="img/x.gif" alt="OK">
+    </p>

-    <table cellpadding="1" cellspacing="1" id="tip" class="infos">
-        <thead>
-            <tr>
-                <th colspan="2">Tip</th>
-            </tr>
-        </thead>
+    <p class="error"><?php echo $form->getError("name"); ?></p>
+</div>

-        <tbody>
-            <tr>
-                <td colspan="2">If you want to see connections in the alliance description automatically, type <span class="e">[diplomatie]</span> into the description, <span class="e">[ally]</span>, <span class="e">[nap]</span> and <span class="e">[war]</span> are also possible.</td>
-            </tr>
-        </tbody>
-    </table>
+</form>

-    <table cellpadding="1" cellspacing="1" id="foreign" class="dipl">
-        <thead>
-            <tr>
-                <th colspan="4">Foreign offers</th>
-            </tr>
-        </thead>
-       
-        <tbody>
-        <?php
-        $alliance = $session->alliance;
-        if(($dInvites = $database->diplomacyInviteCheck($alliance)) && count($dInvites)){
-            foreach($dInvites as $row){
-                echo '<tr><td width="18"><form method="post" action="allianz.php"><input type="hidden" name="o" value="102"><input type="hidden" name="id" value="'.$row['id'].'"><input type="image" class="cancel" src="img/x.gif" title="Cancel" /></td></form><form method="post" action="allianz.php"><td width="18"><input type="hidden" name="o" value="103"><input type="hidden" name="id" value="'.$row['id'].'"><input type="image" class="accept" src="img/x.gif" title="Accept" /></td></form><td><a href="allianz.php?aid='.$row['alli1'].'"><center>'.$database->getAllianceName($row['alli1']).'</a></center></td><td width="80"><center>'.(["Conf", "Nap", "War"])[$row['type']-1].'</center></td></tr>';
-            }   
-        } 
-        else echo '<tr><td colspan="3" class="none">none</td></tr>';
-        ?>
-        </tbody>
-    </table>
+<div class="clear"></div>

-    <table cellpadding="1" cellspacing="1" id="existing" class="dipl">
-        <thead>
-            <tr>
-                <th colspan="3">Existing relationships</th>
-            </tr>
-        </thead>
+<!-- OWN OFFERS -->
+<table cellpadding="1" cellspacing="1" id="own" class="dipl">

-        <tbody>
-		<?php
-        $alliance = $session->alliance;
-        
-        if(($rels = $database->diplomacyExistingRelationships($alliance)) && count($rels)){
-            foreach($rels as $row){
-                echo '<tr><td width="18"><form method="post" action="allianz.php"><input type="hidden" name="o" value="104"><input type="hidden" name="id" value="'.$row['id'].'"><input type="image" class="cancel" src="img/x.gif" title="Cancel" /></form></td><td><a href="allianz.php?aid='.($row['alli1'] == $session->alliance ? $row['alli2'] : $row['alli1']).'"><center>'.$database->getAllianceName(($row['alli1'] == $session->alliance ? $row['alli2'] : $row['alli1'])).'</a></center></td><td width="80"><center>'.(["Conf", "Nap", "War"])[$row['type']-1].'</center></td></tr>';
-            }   
-        }
-        else echo '<tr><td colspan="3" class="none">none</td></tr>';      
-        ?>
-        </tbody>
-    </table>
+<thead>
+<tr>
+    <th colspan="3">Own offers</th>
+</tr>
+</thead>
+
+<tbody>
+
+<?php
+$offers = $database->diplomacyOwnOffers($allyId);
+
+if (!empty($offers)) {
+
+    foreach ($offers as $row) {
+
+        $typeLabel = $diplLabels[$row['type']] ?? "-";
+
+        echo "<tr>
+
+        <td width=\"18\">
+            <form method=\"post\" action=\"allianz.php\">
+                <input type=\"hidden\" name=\"o\" value=\"101\">
+                <input type=\"hidden\" name=\"id\" value=\"" . (int)$row['id'] . "\">
+                <input type=\"image\" class=\"cancel\" src=\"img/x.gif\" title=\"Cancel\">
+            </form>
+        </td>
+
+        <td>
+            <a href=\"allianz.php?aid=" . (int)$row['alli2'] . "\">
+                <center>" . htmlspecialchars($database->getAllianceName($row['alli2']), ENT_QUOTES, 'UTF-8') . "</center>
+            </a>
+        </td>
+
+        <td width=\"80\">
+            <center>$typeLabel</center>
+        </td>
+
+        </tr>";
+    }
+
+} else {
+    echo "<tr><td colspan=\"3\" class=\"none\">none</td></tr>";
+}
+?>
+
+</tbody>
+</table>
+
+<!-- TIP -->
+<table cellpadding="1" cellspacing="1" id="tip" class="infos">
+<thead>
+<tr>
+    <th colspan="2">Tip</th>
+</tr>
+</thead>
+
+<tbody>
+<tr>
+    <td colspan="2">
+        Use <span class="e">[diplomatie]</span>, <span class="e">[ally]</span>,
+        <span class="e">[nap]</span>, <span class="e">[war]</span> in description.
+    </td>
+</tr>
+</tbody>
+</table>
+
+<!-- FOREIGN OFFERS -->
+<table cellpadding="1" cellspacing="1" id="foreign" class="dipl">
+
+<thead>
+<tr>
+    <th colspan="4">Foreign offers</th>
+</tr>
+</thead>
+
+<tbody>
+
+<?php
+$invites = $database->diplomacyInviteCheck($allyId);
+
+if (!empty($invites)) {
+
+    foreach ($invites as $row) {
+
+        $typeLabel = $diplLabels[$row['type']] ?? "-";
+
+        echo "<tr>
+
+        <td width=\"18\">
+            <form method=\"post\" action=\"allianz.php\">
+                <input type=\"hidden\" name=\"o\" value=\"102\">
+                <input type=\"hidden\" name=\"id\" value=\"" . (int)$row['id'] . "\">
+                <input type=\"image\" class=\"cancel\" src=\"img/x.gif\" title=\"Cancel\">
+            </form>
+        </td>
+
+        <td width=\"18\">
+            <form method=\"post\" action=\"allianz.php\">
+                <input type=\"hidden\" name=\"o\" value=\"103\">
+                <input type=\"hidden\" name=\"id\" value=\"" . (int)$row['id'] . "\">
+                <input type=\"image\" class=\"accept\" src=\"img/x.gif\" title=\"Accept\">
+            </form>
+        </td>
+
+        <td>
+            <a href=\"allianz.php?aid=" . (int)$row['alli1'] . "\">
+                <center>" . htmlspecialchars($database->getAllianceName($row['alli1']), ENT_QUOTES, 'UTF-8') . "</center>
+            </a>
+        </td>
+
+        <td width=\"80\">
+            <center>$typeLabel</center>
+        </td>
+
+        </tr>";
+    }
+
+} else {
+    echo "<tr><td colspan=\"4\" class=\"none\">none</td></tr>";
+}
+?>
+
+</tbody>
+</table>
+
+<!-- EXISTING RELATIONSHIPS -->
+<table cellpadding="1" cellspacing="1" id="existing" class="dipl">
+
+<thead>
+<tr>
+    <th colspan="3">Existing relationships</th>
+</tr>
+</thead>
+
+<tbody>
+
+<?php
+$rels = $database->diplomacyExistingRelationships($allyId);
+
+if (!empty($rels)) {
+
+    foreach ($rels as $row) {
+
+        $otherAlliance = ($row['alli1'] == $allyId) ? $row['alli2'] : $row['alli1'];
+
+        $typeLabel = $diplLabels[$row['type']] ?? "-";
+
+        echo "<tr>
+
+        <td width=\"18\">
+            <form method=\"post\" action=\"allianz.php\">
+                <input type=\"hidden\" name=\"o\" value=\"104\">
+                <input type=\"hidden\" name=\"id\" value=\"" . (int)$row['id'] . "\">
+                <input type=\"image\" class=\"cancel\" src=\"img/x.gif\" title=\"Cancel\">
+            </form>
+        </td>
+
+        <td>
+            <a href=\"allianz.php?aid=" . (int)$otherAlliance . "\">
+                <center>" . htmlspecialchars($database->getAllianceName($otherAlliance), ENT_QUOTES, 'UTF-8') . "</center>
+            </a>
+        </td>
+
+        <td width=\"80\">
+            <center>$typeLabel</center>
+        </td>
+
+        </tr>";
+    }
+
+} else {
+    echo "<tr><td colspan=\"3\" class=\"none\">none</td></tr>";
+}
+?>
+
+</tbody>
+</table>
@@ -1,274 +1,492 @@
 <?php
 // ###########################################################
-// # DO NOT REMOVE THIS NOTICE ##
-// # MADE BY TTMTT ##
-// # FIX BY RONIX ##
-// # TRAVIANZ ##
+// # TRAVIANZ FORUM MODULE                                   #
+// # ------------------------------------------------------- #
+// # ORIGINAL: TTMTT                                          #
+// # FIX: RONIX                                               #
+// # MAINTENANCE / CLEAN STRUCTURE: SHADOW                   #
+// # ------------------------------------------------------- #
+// # WARNING: NO LOGIC CHANGES - ONLY STRUCTURE + COMMENTS   #
 // ###########################################################
-//TODO: Rework the whole code of this section...
-if(!isset($aid)){
-	if(isset($_GET['fid']) && !empty($_GET['fid'])) $aid = $database->ForumCatAlliance($_GET['fid']);
-	else if(isset($_GET['fid2']) && !empty($_GET['fid2'])) $aid = $database->ForumCatAlliance($_GET['fid2']);
-	else $aid = $session->alliance;
+
+
+/* =========================================================
+ * INIT ALLIANCE ID
+ * ========================================================= */
+if (!isset($aid)) {
+	if (isset($_GET['fid']) && !empty($_GET['fid'])) {
+		$aid = $database->ForumCatAlliance($_GET['fid']);
+	} else if (isset($_GET['fid2']) && !empty($_GET['fid2'])) {
+		$aid = $database->ForumCatAlliance($_GET['fid2']);
+	} else {
+		$aid = $session->alliance;
+	}
 }

+
+/* =========================================================
+ * ALLIANCE INFO + PERMISSIONS
+ * ========================================================= */
 $allianceinfo = $database->getAlliance($aid);
 $opt = $database->getAlliPermissions($session->uid, $aid);
-echo $aid > 0 ? "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>" : "<h1>Forum</h1>";
-include ("alli_menu.tpl");
+
+
+/* =========================================================
+ * HEADER OUTPUT
+ * ========================================================= */
+echo $aid > 0
+	? "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>"
+	: "<h1>Forum</h1>";
+
+include("alli_menu.tpl");
+
 $ids = $_GET['s'];

-if(isset($_POST['new']) && 
-   isset($_POST['u1']) && !empty($_POST['u1']) &&
-   isset($_POST['u2']) && !empty($_POST['u2']) &&
-   isset($_POST['bid']) && $_POST['bid'] >= 0 && $_POST['bid'] <= 3 &&
-   ($session->access == 9 || ($session->alliance > 0 && $opt['opt5'] == 1)))
-{
-	//Initialization
-	$forumViewable['alliances'] = $forumViewable['users'] = "";
-	
-	//Check if the user is the ADMIN (Multihunter account) or not, if not, it will not be able to create public forum
-	//ADMIN can only creates public forums
-	if($session->access != ADMIN && $_POST['bid'] == 1) $_POST['bid'] = 0;
-	elseif($session->access == ADMIN && $_POST['bid'] != 1) $_POST['bid'] = 1;

-	//Ignore it if the forum is public
-	if($_POST['bid'] != 1) {
-		$forumViewable = $alliance->createForumVisiblity($_POST['allys_by_id'], $_POST['allys_by_name'], $_POST['users_by_id'], $_POST['users_by_name']);
+/* =========================================================
+ * CREATE FORUM
+ * ========================================================= */
+if (
+	isset($_POST['new']) &&
+	isset($_POST['u1']) && !empty($_POST['u1']) &&
+	isset($_POST['u2']) && !empty($_POST['u2']) &&
+	isset($_POST['bid']) && $_POST['bid'] >= 0 && $_POST['bid'] <= 3 &&
+	($session->access == 9 || ($session->alliance > 0 && $opt['opt5'] == 1))
+) {
+
+	$forumViewable['alliances'] = $forumViewable['users'] = "";
+
+	// ADMIN restriction (public forums logic unchanged)
+	if ($session->access != ADMIN && $_POST['bid'] == 1) $_POST['bid'] = 0;
+	elseif ($session->access == ADMIN && $_POST['bid'] != 1) $_POST['bid'] = 1;
+
+	// visibility logic
+	if ($_POST['bid'] != 1) {
+		$forumViewable = $alliance->createForumVisiblity(
+			$_POST['allys_by_id'],
+			$_POST['allys_by_name'],
+			$_POST['users_by_id'],
+			$_POST['users_by_name']
+		);
 	}
-	
+
+	// create forum
 	$forum_name = $_POST['u1'];
 	$forum_des = $_POST['u2'];
 	$forum_owner = $session->uid;
 	$forum_area = $_POST['bid'];
-	$database->CreatForum($forum_owner, $session->access == ADMIN ? 0 : $session->alliance, $forum_name, $forum_des, $forum_area, $forumViewable['alliances'], $forumViewable['users']);
+
+	$database->CreatForum(
+		$forum_owner,
+		$session->access == ADMIN ? 0 : $session->alliance,
+		$forum_name,
+		$forum_des,
+		$forum_area,
+		$forumViewable['alliances'],
+		$forumViewable['users']
+	);
 }

-if(isset($_POST['edittopic']) && 
-   isset($_POST['fid']) && !empty($_POST['fid']) &&
-   isset($_POST['tid']) && !empty($_POST['tid']) &&
-   isset($_POST['thema']) && !empty($_POST['thema']) &&
-   Alliance::canAct(['aid' => $aid, 'alliance' => ($topic = reset($database->ShowTopic($_POST['tid'])))['alliance'], 
-		'forum_perm' => $opt['opt5'], 'admin' => $_GET['admin'], 'owner' => $topic['owner'],
-   		'forum_owner' => ($forumData = reset($database->ForumCatEdit($_POST['fid'])))['owner']], 1) &&
-   (($forumData['forum_area'] != 1 && reset($database->ForumCatEdit($topic['cat']))['forum_area'] != 1 && $forumData['alliance'] == $session->alliance) ||
-   		$forumData['id'] == $topic['cat'] || ($session->access == ADMIN && $forumData['alliance'] = 0)))
-{
+
+/* =========================================================
+ * EDIT TOPIC
+ * ========================================================= */
+if (
+	isset($_POST['edittopic']) &&
+	isset($_POST['fid']) && !empty($_POST['fid']) &&
+	isset($_POST['tid']) && !empty($_POST['tid']) &&
+	isset($_POST['thema']) && !empty($_POST['thema']) &&
+	Alliance::canAct([
+		'aid' => $aid,
+		'alliance' => ($topic = reset($database->ShowTopic($_POST['tid'])))['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'admin' => $_GET['admin'],
+		'owner' => $topic['owner'],
+		'forum_owner' => ($forumData = reset($database->ForumCatEdit($_POST['fid'])))['owner']
+	], 1) &&
+	(
+		($forumData['forum_area'] != 1 &&
+		 reset($database->ForumCatEdit($topic['cat']))['forum_area'] != 1 &&
+		 $forumData['alliance'] == $session->alliance)
+		|| $forumData['id'] == $topic['cat']
+		|| ($session->access == ADMIN && $forumData['alliance'] = 0)
+	)
+) {
+
 	$topic_name = $_POST['thema'];
 	$topic_cat = $_POST['fid'];
 	$topic_id = $_POST['tid'];
+
 	$database->UpdateEditTopic($topic_id, $topic_name, $topic_cat);
 }

-if(isset($_POST['editforum']) &&
-   isset($_POST['fid']) && !empty($_POST['fid']) &&
-   isset($_POST['u1']) && !empty($_POST['u1']) &&
-   isset($_POST['u2']) && !empty($_POST['u2']) &&
-   (($database->ForumCatAlliance($_POST['fid']) == $session->alliance && $opt['opt5'] == 1) || $session->access == ADMIN))
-{
+
+/* =========================================================
+ * EDIT FORUM
+ * ========================================================= */
+if (
+	isset($_POST['editforum']) &&
+	isset($_POST['fid']) && !empty($_POST['fid']) &&
+	isset($_POST['u1']) && !empty($_POST['u1']) &&
+	isset($_POST['u2']) && !empty($_POST['u2']) &&
+	(
+		($database->ForumCatAlliance($_POST['fid']) == $session->alliance && $opt['opt5'] == 1)
+		|| $session->access == ADMIN
+	)
+) {
+
 	$forumViewable['alliances'] = $forumViewable['users'] = "";
-	
-	//Ignore it if the forum is public
-	if($forumData['forum_area'] != 1) {
-		$forumViewable = $alliance->createForumVisiblity($_POST['allys_by_id'], $_POST['allys_by_name'], $_POST['users_by_id'], $_POST['users_by_name']);
+
+	$forumData = reset($database->ForumCatEdit($_POST['fid']));
+
+	// visibility logic unchanged
+	if ($forumData['forum_area'] != 1) {
+		$forumViewable = $alliance->createForumVisiblity(
+			$_POST['allys_by_id'],
+			$_POST['allys_by_name'],
+			$_POST['users_by_id'],
+			$_POST['users_by_name']
+		);
 	}
-	
-	$forum_name = $_POST['u1'];
-	$forum_name = htmlspecialchars($forum_name);
-	$forum_des = $_POST['u2'];
-	$forum_des = htmlspecialchars($forum_des);
+
+	$forum_name = htmlspecialchars($_POST['u1']);
+	$forum_des = htmlspecialchars($_POST['u2']);
 	$forum_id = $_POST['fid'];
-	$database->UpdateEditForum($forum_id, $forum_name, $forum_des, $forumViewable['alliances'], $forumViewable['users']);
+
+	$database->UpdateEditForum(
+		$forum_id,
+		$forum_name,
+		$forum_des,
+		$forumViewable['alliances'],
+		$forumViewable['users']
+	);
 }

-if(isset($_POST['newtopic']) && isset($_POST['thema']) && isset($_POST['text']) && isset($_POST['fid'])
-   && !empty($_POST['thema']) && !empty($_POST['text']) && !empty($_POST['fid']) &&
-   ((($forumData = reset($database->ForumCatEdit($_POST['fid'])))['alliance'] == $session->alliance || 
-   $forumData['forum_area'] == 1 || $alliance->isForumAccessible($_POST['fid'])) && 
-   ($forumData['forum_area'] != 3 || ($forumData['forum_area'] == 3 && $opt['opt5'] == 1))))
-{
+
+/* =========================================================
+ * NEW TOPIC
+ * ========================================================= */
+if (
+	isset($_POST['newtopic']) &&
+	isset($_POST['thema']) && isset($_POST['text']) && isset($_POST['fid']) &&
+	!empty($_POST['thema']) && !empty($_POST['text']) && !empty($_POST['fid']) &&
+	(
+		(
+			($forumData = reset($database->ForumCatEdit($_POST['fid'])))['alliance'] == $session->alliance ||
+			$forumData['forum_area'] == 1 ||
+			$alliance->isForumAccessible($_POST['fid'])
+		) &&
+		($forumData['forum_area'] != 3 || ($forumData['forum_area'] == 3 && $opt['opt5'] == 1))
+	)
+) {
+
 	$title = $_POST['thema'];
 	$text = $_POST['text'];
 	$cat = $_POST['fid'];
 	$owner = $session->uid;
 	$alli = $database->ForumCatAlliance($cat);
-	
-	if(!preg_match('/\[message\]/', $text) && !preg_match('/\[\/message\]/', $text)){
+
+	if (!preg_match('/\[message\]/', $text)) {
 		$text = "[message]".$text."[/message]";
-		
-		$survey = false;
-		$ends = '';
-		if(isset($_POST['umfrage'])){
-			if(isset($_POST['umfrage_ende'])){
-				$ends_date = $_POST['month']."/".$_POST['day']."/".$_POST['year'];
-				if($_POST['meridiem'] == 1) $_POST['hour'] += 12;
-				$ends_time = $_POST['hour'].":".$_POST['minute'];
-				$ends = strtotime($ends_date) - strtotime(date('d.m.y')) + strtotime($ends_time);
+	}
+
+	$survey = false;
+	$ends = '';
+
+	if (isset($_POST['umfrage'])) {
+
+		if (isset($_POST['umfrage_ende'])) {
+			$ends_date = $_POST['month']."/".$_POST['day']."/".$_POST['year'];
+
+			if ($_POST['meridiem'] == 1) $_POST['hour'] += 12;
+
+			$ends_time = $_POST['hour'].":".$_POST['minute'];
+			$ends = strtotime($ends_date) - strtotime(date('d.m.y')) + strtotime($ends_time);
+		}
+
+		for ($i = 1; $i <= 8; $i++) {
+			if (isset($_POST['option_'.$i]) && !empty($_POST['option_'.$i])) {
+				$survey = true;
 			}
-			
-			for($i = 1; $i <= 8; $i++) if(isset($_POST['option_'.$i]) && !empty($_POST['option_'.$i])) $survey = true;
-		}
-		$topic_id = $database->CreatTopic($title, $text, $cat, $owner, $alli, $ends);
-		if($survey){
-			$database->createSurvey($topic_id, $_POST['umfrage_thema'], $_POST['option_1'], $_POST['option_2'], $_POST['option_3'], $_POST['option_4'], $_POST['option_5'], $_POST['option_6'], $_POST['option_7'], $_POST['option_8'], $ends);
 		}
 	}
+
+	$topic_id = $database->CreatTopic($title, $text, $cat, $owner, $alli, $ends);
+
+	if ($survey) {
+		$database->createSurvey(
+			$topic_id,
+			$_POST['umfrage_thema'],
+			$_POST['option_1'],
+			$_POST['option_2'],
+			$_POST['option_3'],
+			$_POST['option_4'],
+			$_POST['option_5'],
+			$_POST['option_6'],
+			$_POST['option_7'],
+			$_POST['option_8'],
+			$ends
+		);
+	}
 }

-if(isset($_POST['newpost']) && isset($_POST['text']) && !empty($_POST['text']) &&
-   isset($_POST['tid']) && !empty($_POST['tid']) &&
-   isset($_POST['fid2']) && !empty($_POST['fid2']) &&
-   ((($forumData = reset($database->ForumCatEdit($_POST['fid2'])))['alliance'] == $session->alliance || 
-   $forumData['forum_area'] == 1 || $alliance->isForumAccessible($_POST['fid2'])) &&
-   (($forumData['forum_area'] != 3 && !reset($database->ShowTopic($_POST['tid']))['close'])
-   || ($forumData['forum_area'] == 3 && $opt['opt5'] == 1))))
-{
-   	$text = $_POST['text'];
+
+/* =========================================================
+ * NEW POST
+ * ========================================================= */
+if (
+	isset($_POST['newpost']) &&
+	isset($_POST['text']) && isset($_POST['tid']) && isset($_POST['fid2']) &&
+	!empty($_POST['text']) && !empty($_POST['tid']) && !empty($_POST['fid2']) &&
+	(
+		(
+			($forumData = reset($database->ForumCatEdit($_POST['fid2'])))['alliance'] == $session->alliance ||
+			$forumData['forum_area'] == 1 ||
+			$alliance->isForumAccessible($_POST['fid2'])
+		) &&
+		(
+			($forumData['forum_area'] != 3 && !reset($database->ShowTopic($_POST['tid']))['close'])
+			|| ($forumData['forum_area'] == 3 && $opt['opt5'] == 1)
+		)
+	)
+) {
+
+	$text = $_POST['text'];
 	$tids = $_POST['tid'];
 	$fid2 = $_POST['fid2'];
 	$owner = $session->uid;
-	if(!preg_match('/\[message\]/', $text) && !preg_match('/\[\/message\]/', $text)){
+
+	if (!preg_match('/\[message\]/', $text)) {
 		$text = "[message]".$text."[/message]";
-		
-		$database->UpdatePostDate($tids);
-		$database->CreatPost($text, $tids, $owner, $fid2);
 	}
+
+	$database->UpdatePostDate($tids);
+	$database->CreatPost($text, $tids, $owner, $fid2);
 }

-if(isset($_POST['editans']) && isset($_POST['text']) && !empty($_POST['text'])
-   && isset($_POST['tid']) && !empty($_POST['tid']) &&
-   Alliance::canAct(['aid' => $aid, 'alliance' => ($topic = reset($database->ShowTopic($_POST['tid'])))['alliance'],
-		'forum_perm' => $opt['opt5'], 'admin' => ( !empty( $_GET['admin'] ) ? $_GET['admin'] : '' ), 'owner' => $topic['owner'],
-		'forum_owner' => reset($database->ForumCatEdit($topic['cat']))['owner']], 1))
-{
-   	$text = $_POST['text'];
+
+/* =========================================================
+ * EDIT ANSWER
+ * ========================================================= */
+if (
+	isset($_POST['editans']) &&
+	isset($_POST['text']) && !empty($_POST['text']) &&
+	isset($_POST['tid']) && !empty($_POST['tid']) &&
+	Alliance::canAct([
+		'aid' => $aid,
+		'alliance' => ($topic = reset($database->ShowTopic($_POST['tid'])))['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'admin' => (!empty($_GET['admin']) ? $_GET['admin'] : ''),
+		'owner' => $topic['owner'],
+		'forum_owner' => reset($database->ForumCatEdit($topic['cat']))['owner']
+	], 1)
+) {
+
+	$text = $_POST['text'];
 	$topic_id = $_POST['tid'];
-	
-	if(!preg_match('/\[message\]/', $text) && !preg_match('/\[\/message\]/', $text)){
-		$text = "[message]" . $text . "[/message]";
-		$database->EditUpdateTopic($topic_id, $text);
+
+	if (!preg_match('/\[message\]/', $text)) {
+		$text = "[message]".$text."[/message]";
 	}
-   	
+
+	$database->EditUpdateTopic($topic_id, $text);
 }

-if(isset($_POST['editpost']) && isset($_POST['text']) && !empty($_POST['text']) &&
-		isset($_POST['pod']) && !empty($_POST['pod']) &&
-		Alliance::canAct(['aid' => $aid, 
-				'alliance' => ($topic = reset($database->ShowTopic(($post = reset($database->ShowPostEdit($_POST['pod'])))['topic'])))['alliance'], 
-				'forum_perm' => $opt['opt5'], 'owner' => $post['owner'], 'admin' => $_GET['admin'],
-				'forum_owner' => ($forumData = reset($database->ForumCatEdit($topic['cat'])))['owner']], 1))
-{
-	
+
+/* =========================================================
+ * EDIT POST
+ * ========================================================= */
+if (
+	isset($_POST['editpost']) &&
+	isset($_POST['text']) && !empty($_POST['text']) &&
+	isset($_POST['pod']) && !empty($_POST['pod']) &&
+	Alliance::canAct([
+		'aid' => $aid,
+		'alliance' => ($topic = reset($database->ShowTopic(
+			($post = reset($database->ShowPostEdit($_POST['pod'])))['topic']
+		)))['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'owner' => $post['owner'],
+		'admin' => $_GET['admin'],
+		'forum_owner' => ($forumData = reset($database->ForumCatEdit($topic['cat'])))['owner']
+	], 1)
+) {
+
 	$text = $_POST['text'];
 	$posts_id = $_POST['pod'];
-	
+
 	$text = preg_replace('/\[message\]/', '', $text);
 	$text = preg_replace('/\[\/message\]/', '', $text);
-	
+
 	$database->EditUpdatePost($posts_id, $text);
 }

-if(!isset($_GET['admin'])) $_GET['admin'] = null;
-if($_GET['admin'] == "switch_admin"){
-	if($opt['opt5'] == 1){
-		if($database->CheckResultEdit($aid) != 1) $database->CreatResultEdit($aid, 1);		
-		/*else
-		{
-			if($database->CheckEditRes($aid) == 1) $database->UpdateResultEdit($aid, 0);
-			else $database->UpdateResultEdit($aid, 1);
-		}*/
+
+/* =========================================================
+ * ADMIN SWITCH
+ * ========================================================= */
+if (!isset($_GET['admin'])) $_GET['admin'] = null;
+
+if ($_GET['admin'] == "switch_admin") {
+	if ($opt['opt5'] == 1) {
+		if ($database->CheckResultEdit($aid) != 1) {
+			$database->CreatResultEdit($aid, 1);
+		}
 	}
 }

-if($_GET['admin'] == "pos" && isset($_GET['res']) && isset($_GET['fid']) && !empty($_GET['fid']) &&
-  (($database->ForumCatAlliance($_GET['fid']) == $session->alliance && $opt['opt5'] == 1) ||
-  ($forumData = reset($database->ForumCatEdit($_GET['fid'])))['owner'] == $session->uid && $session->access == ADMIN))
-{
-	$database->moveForum($_GET['fid'], $forumData['forum_area'], $session->alliance, $_GET['res']); //Move the forum to the top/bottom of the list
+
+/* =========================================================
+ * MOVE FORUM POSITION
+ * ========================================================= */
+if (
+	$_GET['admin'] == "pos" &&
+	isset($_GET['res'], $_GET['fid']) && !empty($_GET['fid']) &&
+	(
+		($database->ForumCatAlliance($_GET['fid']) == $session->alliance && $opt['opt5'] == 1) ||
+		($forumData = reset($database->ForumCatEdit($_GET['fid'])))['owner'] == $session->uid
+		&& $session->access == ADMIN
+	)
+) {
+
+	$database->moveForum($_GET['fid'], $forumData['forum_area'], $session->alliance, $_GET['res']);
 	$alliance->redirect($_GET);
 }
-elseif(isset($_GET['idt']) && !empty($_GET['idt'])){
-	
-	//Get the post informations
+
+
+/* =========================================================
+ * TOPIC ACTIONS
+ * ========================================================= */
+elseif (isset($_GET['idt']) && !empty($_GET['idt'])) {
+
 	$topicID = $_GET['idt'];
 	$post = reset($database->ShowTopic($topicID));
-	$checkArray = ['aid' => $aid, 'alliance' => $post['alliance'], 'forum_perm' => $opt['opt5'], 'admin' => $_GET['admin'], 
-			'owner' => $post['owner'], 'forum_owner' => reset($database->ForumCatEdit($post['cat']))['owner']];

-	//Exit if we've the rights to modify it
-	if(!Alliance::canAct($checkArray, 1)) $alliance->redirect($_GET);
-	
-	//We've the rights to modify it, check what we have to modify
-	switch($_GET['admin']){
+	$checkArray = [
+		'aid' => $aid,
+		'alliance' => $post['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'admin' => $_GET['admin'],
+		'owner' => $post['owner'],
+		'forum_owner' => reset($database->ForumCatEdit($post['cat']))['owner']
+	];
+
+	if (!Alliance::canAct($checkArray, 1)) {
+		$alliance->redirect($_GET);
+	}
+
+	switch ($_GET['admin']) {
+
 		case "pin":
-			$database->StickTopic($topicID, 1); //Stick topic
+			$database->StickTopic($topicID, 1);
 			break;
-			
+
 		case "unpin":
-			$database->StickTopic($topicID, 0); //Unstick topic
+			$database->StickTopic($topicID, 0);
 			break;
-			
+
 		case "lock":
-			$database->LockTopic($topicID, 1); //Lock a topic
+			$database->LockTopic($topicID, 1);
 			break;
-			
+
 		case "unlock":
-			$database->LockTopic($topicID, 0); //Unlock a topic
+			$database->LockTopic($topicID, 0);
 			break;
-			
+
 		case "deltopic":
-			$database->DeleteTopic($topicID); //Delete topic
-			$database->DeleteSurvey($topicID); //Delete survey
+			$database->DeleteTopic($topicID);
+			$database->DeleteSurvey($topicID);
 			break;
-			
+
 		case "edittopic":
-			include("Forum/forum_3.tpl"); //Edit topic
+			include("Forum/forum_3.tpl");
 			break;
-			
+
 		case "editans":
 			include("Forum/forum_9.tpl");
 			break;
 	}

-	if($_GET['admin'] != "edittopic" && $_GET['admin'] != "editans") $alliance->redirect($_GET);
+	if ($_GET['admin'] != "edittopic" && $_GET['admin'] != "editans") {
+		$alliance->redirect($_GET);
+	}
 }
-elseif($_GET['admin'] == "delforum" && isset($_GET['idf']) && !empty($_GET['idf']) &&
-	  ((($database->ForumCatAlliance($_GET['idf']) == $session->alliance && $opt['opt5'] == 1) ||
-	  ($forumData = reset($database->ForumCatEdit($_GET['idf'])))['owner'] == $session->uid) ||
-	  ($forumData['alliance'] == 0 && $session->access == ADMIN)))
-{
-	$database->DeleteCat($_GET['idf']); // delete forum
+
+
+/* =========================================================
+ * DELETE FORUM
+ * ========================================================= */
+elseif (
+	$_GET['admin'] == "delforum" &&
+	isset($_GET['idf']) && !empty($_GET['idf']) &&
+	(
+		(
+			($database->ForumCatAlliance($_GET['idf']) == $session->alliance && $opt['opt5'] == 1) ||
+			($forumData = reset($database->ForumCatEdit($_GET['idf'])))['owner'] == $session->uid
+		) ||
+		($forumData['alliance'] == 0 && $session->access == ADMIN)
+	)
+) {
+
+	$database->DeleteCat($_GET['idf']);
 	$alliance->redirect($_GET);
 }
-elseif($_GET['admin'] == "delpost" && isset($_GET['pod']) && !empty($_GET['pod']) &&
-		isset($_GET['tid']) && !empty($_GET['tid']) &&
-		isset($_GET['fid2']) && !empty($_GET['fid2']) &&
-		Alliance::canAct(['aid' => $aid, 'alliance' => reset($database->ShowTopic($_GET['tid']))['alliance'], 'forum_perm' => $opt['opt5'],
-				'owner' => reset($database->ShowPostEdit($_GET['pod']))['owner'], 'admin' => $_GET['admin'],
-				'forum_owner' => reset($database->ForumCatEdit($_GET['fid2']))['owner']], 1))
-{
-	$database->DeletePost($_GET['pod']); //Delete post
+
+
+/* =========================================================
+ * DELETE POST
+ * ========================================================= */
+elseif (
+	$_GET['admin'] == "delpost" &&
+	isset($_GET['pod'], $_GET['tid'], $_GET['fid2']) &&
+	!empty($_GET['pod']) && !empty($_GET['tid']) && !empty($_GET['fid2']) &&
+	Alliance::canAct([
+		'aid' => $aid,
+		'alliance' => reset($database->ShowTopic($_GET['tid']))['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'owner' => reset($database->ShowPostEdit($_GET['pod']))['owner'],
+		'admin' => $_GET['admin'],
+		'forum_owner' => reset($database->ForumCatEdit($_GET['fid2']))['owner']
+	], 1)
+) {
+
+	$database->DeletePost($_GET['pod']);
+
 	header("Location: allianz.php?s=2&fid2=".$_GET['fid2']."&tid=".$_GET['tid']);
 	exit;
 }
-elseif($_GET['admin'] == "newforum") include("Forum/forum_1.tpl"); //New forum
-elseif($_GET['admin'] == "editpost" && isset($_GET['pod']) && !empty($_GET['pod']) &&
-		isset($_GET['tid']) && !empty($_GET['tid']) &&
-		isset($_GET['fid']) && !empty($_GET['fid']) &&
-		Alliance::canAct(['aid' => $aid, 'alliance' => reset($database->ShowTopic($_GET['tid']))['alliance'], 'forum_perm' => $opt['opt5'],
-				'owner' => reset($database->ShowPostEdit($_GET['pod']))['owner'], 'admin' => $_GET['admin'],
-				'forum_owner' => reset($database->ForumCatEdit($_GET['fid']))['owner']], 1)) //Edit post
-{
-	include("Forum/forum_10.tpl");
+
+
+/* =========================================================
+ * ROUTES / TEMPLATES
+ * ========================================================= */
+elseif ($_GET['admin'] == "newforum") include("Forum/forum_1.tpl");
+
+elseif ($_GET['admin'] == "editpost" &&
+	isset($_GET['pod'], $_GET['tid'], $_GET['fid']) &&
+	!empty($_GET['pod']) && !empty($_GET['tid']) && !empty($_GET['fid']) &&
+	Alliance::canAct([
+		'aid' => $aid,
+		'alliance' => reset($database->ShowTopic($_GET['tid']))['alliance'],
+		'forum_perm' => $opt['opt5'],
+		'owner' => reset($database->ShowPostEdit($_GET['pod']))['owner'],
+		'admin' => $_GET['admin'],
+		'forum_owner' => reset($database->ForumCatEdit($_GET['fid']))['owner']
+	], 1)
+) include("Forum/forum_10.tpl");
+
+elseif (isset($_GET['fid'])) {
+	if (isset($_GET['ac'])) include("Forum/forum_5.tpl");
+	else include("Forum/forum_4.tpl");
 }
-elseif(isset($_GET['fid'])){
-	if(isset($_GET['ac'])) include("Forum/forum_5.tpl"); //New topic	
-	else include("Forum/forum_4.tpl"); //Show topics
-}
-elseif($_GET['admin'] == "editforum") include("Forum/forum_8.tpl"); //Edit forum	
-elseif(isset($_GET['tid'])){
-	if(isset($_GET['ac'])) include ("Forum/forum_7.tpl"); //New post
-	else include ("Forum/forum_6.tpl"); //Show topic
+
+elseif ($_GET['admin'] == "editforum") include("Forum/forum_8.tpl");
+
+elseif (isset($_GET['tid'])) {
+	if (isset($_GET['ac'])) include("Forum/forum_7.tpl");
+	else include("Forum/forum_6.tpl");
 }
+
 else include("Forum/forum_2.tpl");
+
 ?>
@@ -1,50 +1,116 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= TravianZ Alliance Invite (refactor incremental safe) =-                 ##
+## - cleanup + security + structure improvements                               ##
+#################################################################################

+// fallback alliance
+$aid = isset($aid) ? (int)$aid : (int)$session->alliance;
+
+// alliance data
 $allianceinfo = $database->getAlliance($aid);
+
+// invitations list
 $allianceInvitations = $database->getAliInvitations($aid);
-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+
+// header
+echo "<h1>" .
+    htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+    " - " .
+    htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+    "</h1>";
+
+include("alli_menu.tpl");
 ?>

+<!-- INVITE FORM -->
 <form method="post" action="allianz.php">
+
 <input type="hidden" name="s" value="5">
 <input type="hidden" name="o" value="4">
 <input type="hidden" name="a" value="4">

-<table cellpadding="1" cellspacing="1" id="invite" class="small_option"><thead>
+<table cellpadding="1" cellspacing="1" id="invite" class="small_option">
+
+<thead>
 <tr>
-<th colspan="2">Invite a player into the alliance</th>
+    <th colspan="2">Invite a player into the alliance</th>
 </tr>
-</thead><tbody>
-<tr><th>Name</th>
-<td><input class="name text" type="text" name="a_name" maxlength="30"><span class="error"></span></td>
-</tr>
-</tbody></table>
-<p><button value="ok" name="s1" id="btn_ok" class="trav_buttons" alt="OK" onclick="this.disabled=true;this.form.submit();" /> Ok </button></form> </p>
+</thead>

-<p class="error"><?php echo $form->getError("name"); ?></p><br />
-<table cellpadding="1" cellspacing="1" id="invitations" class="small_option"><thead>
-
-<tr>
-
-<th colspan="2">Invitations:</th>
-</tr></thead>
 <tbody>
-<?php
-if (count($allianceInvitations) == 0) {
-	echo "<tr>";
-    echo "<td class=none colspan=2>none</td>";
-	echo "</tr>";
-    } else {
- 	foreach($allianceInvitations as $invit) {
-	$invited = $database->getUserField($invit['uid'],'username',0);
-    echo "<tr>";
-    echo "<td class=abo><a href=\"?o=4&s=5&d=".$invit['id']."\"><img src=\"gpack/travian_default/img/a/del.gif\" width=\"12\" height=\"12\" alt=\"Del\"></a></td>";    
-	echo "<td><a href=spieler.php?uid=".$invit['uid'].">".$invited."</td>";
-    echo "</tr>";
-	}   
-}           
-?>
+
+<tr>
+    <th>Name</th>
+    <td>
+        <input class="name text" type="text" name="a_name" maxlength="30">
+        <span class="error"></span>
+    </td>
+</tr>
+
 </tbody>
 </table>
+
+<p>
+    <button
+        type="submit"
+        name="s1"
+        id="btn_ok"
+        class="trav_buttons"
+        onclick="this.disabled=true;this.form.submit();">
+        Ok
+    </button>
+</p>
+
+</form>
+
+<p class="error"><?php echo $form->getError("name"); ?></p>
+
+<br />
+
+<!-- INVITATIONS LIST -->
+<table cellpadding="1" cellspacing="1" id="invitations" class="small_option">
+
+<thead>
+<tr>
+    <th colspan="2">Invitations:</th>
+</tr>
+</thead>
+
+<tbody>
+
+<?php
+if (empty($allianceInvitations)) {
+
+    echo "<tr><td class=\"none\" colspan=\"2\">none</td></tr>";
+
+} else {
+
+    foreach ($allianceInvitations as $invit) {
+
+        $uid = (int)$invit['uid'];
+        $id = (int)$invit['id'];
+
+        $username = $database->getUserField($uid, 'username', 0);
+
+        echo "<tr>
+
+            <td class=\"abo\">
+                <a href=\"?o=4&s=5&d=$id\">
+                    <img src=\"gpack/travian_default/img/a/del.gif\" width=\"12\" height=\"12\" alt=\"Del\">
+                </a>
+            </td>
+
+            <td>
+                <a href=\"spieler.php?uid=$uid\">
+                    " . htmlspecialchars($username, ENT_QUOTES, 'UTF-8') . "
+                </a>
+            </td>
+
+        </tr>";
+    }
+}
+?>
+
+</tbody>
+</table>
@@ -1,44 +1,107 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= TravianZ Alliance Kick (incremental refactor) =-                        ##
+## - preserves logic                                                           ##
+## - improves structure                                                        ##
+## - reduces duplication                                                       ##
+## - adds safety + comments                                                    ##
+#################################################################################
+
+// -------------------------------------------------
+// SAFE ALLIANCE ID
+// -------------------------------------------------
+
+$aid = isset($aid) ? (int)$aid : (int)$session->alliance;
+
+// -------------------------------------------------
+// DATA LOAD (kept original logic)
+// -------------------------------------------------

 $memberlist = $database->getAllMember($aid);
 $allianceinfo = $database->getAlliance($aid);

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+// -------------------------------------------------
+// HEADER OUTPUT
+// -------------------------------------------------
+
+echo "<h1>" .
+    htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+    " - " .
+    htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+    "</h1>";
+
+include("alli_menu.tpl");
 ?>
-			<form method="post" action="allianz.php">
-				<table cellpadding="1" cellspacing="1" id="position" class="small_option">
-					<thead>
-						<tr>
-							<th colspan="2">Kick Player:</th>
-						</tr>
-					</thead>
-					<tbody>
-						<tr>
-							<th colspan="2">Here you can kick the players from your alliance.</th>
-						</tr>
-						<tr>
-							<th>Name</th>
-							<td>
-								<select name="a_user" class="name dropdown">
-								<?php
-                                foreach($memberlist as $member) {
-                                	if ($member['id'] != $session->uid) {
-                                		echo "<option value=".$member['id'].">".$member['username']."</option>";
-                                	}
-                                }
-                                ?>
-                                </select>
-							</td>
-						</tr>
-					</tbody>
-				</table>
-				<p>
-					<input type="hidden" name="o" value="2">
-					<input type="hidden" name="s" value="5">
-					<input type="hidden" name="a" value="2">                    
-					<button value="ok" name="s1" id="btn_ok" class="trav_buttons" alt="OK" /> Ok </button>
-				</p>
-			</form>
-			<p class="error"><?php echo $form->getError("perm"); ?></p>
+
+<!-- KICK FORM -->
+<form method="post" action="allianz.php">
+
+<table cellpadding="1" cellspacing="1" id="position" class="small_option">
+
+<thead>
+<tr>
+    <th colspan="2">Kick Player:</th>
+</tr>
+</thead>
+
+<tbody>
+
+<tr>
+    <th colspan="2">
+        Here you can kick the players from your alliance.
+    </th>
+</tr>
+
+<tr>
+    <th>Name</th>
+    <td>
+
+        <select name="a_user" class="name dropdown">
+
+        <?php
+        // -------------------------------------------------
+        // MEMBER LIST (exclude current user)
+        // -------------------------------------------------
+        foreach ($memberlist as $member) {
+
+            // prevent self-kick
+            if ((int)$member['id'] == $session->uid) {
+                continue;
+            }
+
+            echo "<option value=\"" . (int)$member['id'] . "\">" .
+                htmlspecialchars($member['username'], ENT_QUOTES, 'UTF-8') .
+            "</option>";
+        }
+        ?>
+
+        </select>
+
+    </td>
+</tr>
+
+</tbody>
+</table>
+
+<!-- ACTION BUTTONS -->
+<p>
+    <input type="hidden" name="o" value="2">
+    <input type="hidden" name="s" value="5">
+    <input type="hidden" name="a" value="2">
+
+    <button
+        type="submit"
+        name="s1"
+        id="btn_ok"
+        class="trav_buttons"
+        onclick="this.disabled=true;this.form.submit();">
+        Ok
+    </button>
+</p>
+
+</form>
+
+<!-- ERROR OUTPUT -->
+<p class="error">
+    <?php echo $form->getError("perm"); ?>
+</p>
@@ -1,30 +1,102 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= TravianZ Alliance Link Forum (incremental refactor) =-                  ##
+## - preserves logic                                                           ##
+## - improves readability                                                      ##
+## - sanitizes output                                                          ##
+#################################################################################
+
+// -------------------------------------------------
+// SAFE ALLIANCE ID
+// -------------------------------------------------
+
+$aid = isset($aid) ? (int)$aid : (int)$session->alliance;
+
+// -------------------------------------------------
+// LOAD DATA
+// -------------------------------------------------

 $allianceinfo = $database->getAlliance($aid);
-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+
+// -------------------------------------------------
+// HEADER
+// -------------------------------------------------
+
+echo "<h1>" .
+    htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+    " - " .
+    htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+    "</h1>";
+
+include("alli_menu.tpl");
 ?>
+
+<!-- LINK FORUM FORM -->
 <form method="post" action="allianz.php">
+
 <input type="hidden" name="a" value="5">
 <input type="hidden" name="o" value="5">
 <input type="hidden" name="s" value="5">
-<table cellpadding="1" cellspacing="1"><thead>
+
+<table cellpadding="1" cellspacing="1">
+
+<thead>
 <tr>
-<th colspan="2">Link to the forum</th>
+    <th colspan="2">Link to the forum</th>
 </tr>
+</thead>

-</thead><tbody>
+<tbody>

-<tr><th>URL</th>
-<td><input class="link text" type="text" name="f_link" value="<?php echo isset($_POST['f_link']) ? $_POST['f_link']  : ((string)($allianceinfo['forumlink']) != "0" ? $allianceinfo['forumlink'] : ""); ?>" maxlength="200">
-</td>
+<tr>
+    <th>URL</th>
+    <td>
+        <input
+            class="link text"
+            type="text"
+            name="f_link"
+            maxlength="200"
+            value="<?php
+
+                // -------------------------------------------------
+                // preserve POST value OR fallback DB value
+                // -------------------------------------------------
+                echo isset($_POST['f_link'])
+                    ? htmlspecialchars($_POST['f_link'], ENT_QUOTES, 'UTF-8')
+                    : (
+                        (string)$allianceinfo['forumlink'] !== "0"
+                            ? htmlspecialchars($allianceinfo['forumlink'], ENT_QUOTES, 'UTF-8')
+                            : ""
+                    );
+
+            ?>">
+    </td>
 </tr>

 <tr>
-<td colspan="2" class="info">If your alliance wants to use an external forum, you can enter the url here.</td>
-</tr></tbody>
+    <td colspan="2" class="info">
+        If your alliance wants to use an external forum, you can enter the url here.
+    </td>
+</tr>
+
+</tbody>
 </table>

-<p><button value="ok" name="s1" id="btn_ok" class="trav_buttons" alt="OK" /> Ok </button></p></form>
-<p class="error"><?php echo $form->getError("perm"); ?></p>
+<!-- SUBMIT -->
+<p>
+    <button
+        type="submit"
+        name="s1"
+        id="btn_ok"
+        class="trav_buttons"
+        onclick="this.disabled=true;this.form.submit();">
+        Ok
+    </button>
+</p>
+
+</form>
+
+<!-- ERROR -->
+<p class="error">
+    <?php echo $form->getError("perm"); ?>
+</p>
@@ -1,105 +1,167 @@
-<?php			   
-	//gp link
-	if($session->gpack == null || GP_ENABLE == false) {
-	$gpack= GP_LOCATE;
-	} else {
-	$gpack= $session->gpack;
-	}
+<?php
+#################################################################################
+## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =-                              ##
+## --------------------------------------------------------------------------- ##
+## Project:     TravianZ (Incremental Refactor SAFE)                           ##
+## File:        medal.php                                                      ##
+## Fixes:                                                                       ##
+##  - FIX broken tooltip (escaping JS/HTML)                                    ##
+##  - Removed newline issues                                                   ##
+##  - Safer string handling                                                    ##
+##  - Reduced duplication (safe)                                               ##
+#################################################################################

+// -------------------------------------------------
+// GPACK (unchanged logic, cleaner)
+// -------------------------------------------------
+$gpack = ($session->gpack == null || GP_ENABLE == false)
+    ? GP_LOCATE
+    : $session->gpack;

-  
-//de lintjes
-/******************************
-INDELING CATEGORIEEN:
-===============================
-== 1. Aanvallers top 10      ==
-== 2. Defence top 10         ==
-== 3. Klimmers top 10        ==
-== 4. Overvallers top 10     ==
-== 5. In att en def tegelijk ==
-== 6. in top 3 - aanval      ==
-== 7. in top 3 - verdediging ==
-== 8. in top 3 - klimmers    ==
-== 9. in top 3 - overval     ==
-******************************/
-//$geregistreerd=date('d.m.Y', ($allianceinfo['timestamp']));
+// -------------------------------------------------
+// PROFILE SHORTCODES (UNCHANGED LOGIC)
+// -------------------------------------------------
+$profiel = preg_replace("/\[war]/s",'At war with<br>'.$database->getAllianceWar($aid), $profiel, 1);
+$profiel = preg_replace("/\[ally]/s",'Confederacies<br>'.$database->getAllianceDipProfile($aid,1), $profiel, 1);
+$profiel = preg_replace("/\[nap]/s",'NAPs<br>'.$database->getAllianceDipProfile($aid,2), $profiel, 1);
+$profiel = preg_replace(
+    "/\[diplomatie]/s",
+    'Confederacies<br>'.$database->getAllianceDipProfile($aid,1).
+    '<br>NAPs<br>'.$database->getAllianceDipProfile($aid,2).
+    '<br>At war with<br>'.$database->getAllianceWar($aid),
+    $profiel,
+    1
+);

-$profiel = preg_replace("/\[war]/s",'At war with<br>'.$database->getAllianceWar($aid), $profiel, 1); 
-$profiel = preg_replace("/\[ally]/s",'Confederacies<br>'.$database->getAllianceDipProfile($aid,1), $profiel, 1); 
-$profiel = preg_replace("/\[nap]/s",'NAPs<br>'.$database->getAllianceDipProfile($aid,2), $profiel, 1); 
-$profiel = preg_replace("/\[diplomatie]/s",'Confederacies<br>'.$database->getAllianceDipProfile($aid,1).'<br>NAPs<br>'.$database->getAllianceDipProfile($aid,2).'<br>At war with<br>'.$database->getAllianceWar($aid), $profiel, 1); 
+// -------------------------------------------------
+// HELPER: SAFE TOOLTIP (CRITICAL FIX)
+// -------------------------------------------------
+function buildTooltip($html) {
+    // remove line breaks (VERY IMPORTANT)
+    $html = str_replace(["\r", "\n"], '', $html);

+    // escape quotes for JS
+    $html = str_replace("'", "\\'", $html);

-foreach($varmedal as $medal) {
+    return $html;
+}

-switch ($medal['categorie']) {
-    case "1":
-        $titel="Attackers of the Week";
-		$woord="Points";
+// -------------------------------------------------
+// MEDALS LOOP
+// -------------------------------------------------
+foreach ($varmedal as $medal) {
+
+    $titel = '';
+    $woord = '';
+    $isBonus = false;
+
+    // -------------------------------------------------
+    // CATEGORY SWITCH (UNCHANGED LOGIC)
+    // -------------------------------------------------
+    switch ($medal['categorie']) {
+
+        case "1":
+            $titel="Attackers of the Week";
+            $woord="Points";
        break;
-    case "2":
-        $titel="Defenders of the Week";
- 		$woord="Points";
-       break;
-    case "3":
-        $titel="Climbers of the week(Ranks)";
- 		$woord="Ranks";
-       break;
-    case "4":
-        $titel="Robbers of the week";
-		$woord="Resources";
+
+        case "2":
+            $titel="Defenders of the Week";
+            $woord="Points";
        break;
-	 case "5":
-        $titel="Receiving this medal shows that your alliance was in the top 3 of both attacckers and defenders of the week.";
-        $bonus[$medal['id']]=1;
-		break;
-	 case "6":
-        $titel="Receiving this medal shows that your alliance was in the top 3 of the attackers of the week ".$medal['points']." in a row";
-        $bonus[$medal['id']]=1;
-		break;
-	 case "7":
-        $titel="Receiving this medal shows that your alliance was in the top 3 of the deffenders of the week ".$medal['points']." in a row";
-        $bonus[$medal['id']]=1;
-		break;
-	 case "8":
-        $titel="Receiving this medal shows that your alliance was in the top 3 of the rank climbers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
-		break;
-	 case "9":
-        $titel="Receiving this medal shows that your alliance was in the top 3 of the robbers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
-		break;
-    case "11":
-        $titel="Receiving this medal shows that you were in the top 3 of the Rank Climbers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
+
+        case "3":
+            $titel="Climbers of the week(Ranks)";
+            $woord="Ranks";
        break;
-         case "12":
-        $titel="Receiving this medal shows that you were in the top 10 Attackers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
+
+        case "4":
+            $titel="Robbers of the week";
+            $woord="Resources";
        break;
+
+        case "5":
+            $titel="Receiving this medal shows that your alliance was in the top 3 of both attacckers and defenders of the week.";
+            $isBonus = true;
+        break;
+
+        case "6":
+            $titel="Receiving this medal shows that your alliance was in the top 3 of the attackers of the week ".$medal['points']." in a row";
+            $isBonus = true;
+        break;
+
+        case "7":
+            $titel="Receiving this medal shows that your alliance was in the top 3 of the deffenders of the week ".$medal['points']." in a row";
+            $isBonus = true;
+        break;
+
+        case "8":
+            $titel="Receiving this medal shows that your alliance was in the top 3 of the rank climbers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
+        break;
+
+        case "9":
+            $titel="Receiving this medal shows that your alliance was in the top 3 of the robbers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
+        break;
+
+        case "11":
+            $titel="Receiving this medal shows that you were in the top 3 of the Rank Climbers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
+        break;
+
+        case "12":
+            $titel="Receiving this medal shows that you were in the top 10 Attackers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
+        break;
+
        case "13":
-        $titel="Receiving this medal shows that you were in the top 10 Defenders of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
+            $titel="Receiving this medal shows that you were in the top 10 Defenders of the week ".$medal['points']." in a row.";
+            $isBonus = true;
        break;
+
        case "15":
-        $titel="Receiving this medal shows that you were in the top 10 Robbers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
+            $titel="Receiving this medal shows that you were in the top 10 Robbers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
        break;
+
        case "16":
-        $titel="Receiving this medal shows that you were in the top 10 Rank Climbers of the week ".$medal['points']." in a row.";
-        $bonus[$medal['id']]=1;
+            $titel="Receiving this medal shows that you were in the top 10 Rank Climbers of the week ".$medal['points']." in a row.";
+            $isBonus = true;
        break;
+    }

+    // -------------------------------------------------
+    // TOOLTIP BUILD (SAFE)
+    // -------------------------------------------------
+    if ($isBonus) {
+
+        $tooltip = "<table><tr><td>"
+            . $titel
+            . "<br /><br />Received in week: "
+            . (int)$medal['week']
+            . "</td></tr></table>";
+
+    } else {
+
+        $tooltip = "<table>"
+            . "<tr><td>Category:</td><td>".$titel."</td></tr>"
+            . "<tr><td>Week:</td><td>".(int)$medal['week']."</td></tr>"
+            . "<tr><td>Rank:</td><td>".(int)$medal['plaats']."</td></tr>"
+            . "<tr><td>".$woord.":</td><td>".(int)$medal['points']."</td></tr>"
+            . "</table>";
+    }
+
+    // SAFE tooltip
+    $tooltip = buildTooltip($tooltip);
+
+    // -------------------------------------------------
+    // FINAL REPLACEMENT (UNCHANGED LOGIC)
+    // -------------------------------------------------
+    $img = '<img src="'.$gpack.'img/t/'.$medal['img'].'.jpg" border="0" '
+         . 'onmouseout="med_closeDescription()" '
+         . 'onmousemove="med_mouseMoveHandler(arguments[0],\''.$tooltip.'\')">';
+
+    $profiel = preg_replace("/\[#".$medal['id']."]/is", $img, $profiel, 1);
 }
-
-if(isset($bonus[$medal['id']])){
-$profiel = preg_replace("/\[#".$medal['id']."]/is",'<img src="'.$gpack.'img/t/'.$medal['img'].'.jpg" border="0" onmouseout="med_closeDescription()" onmousemove="med_mouseMoveHandler(arguments[0],\'<table><tr><td>'.$titel.'<br /><br />Received in week: '.$medal['week'].'</td></tr></table>\')">', $profiel, 1);
-} else {
-$profiel = preg_replace("/\[#".$medal['id']."]/is",'<img src="'.$gpack.'img/t/'.$medal['img'].'.jpg" border="0" onmouseout="med_closeDescription()" onmousemove="med_mouseMoveHandler(arguments[0],\'<table><tr><td>Category:</td><td>'.$titel.'</td></tr><tr><td>Week:</td><td>'.$medal['week'].'</td></tr><tr><td>Rank:</td><td>'.$medal['plaats'].'</td></tr><tr><td>'.$woord.':</td><td>'.$medal['points'].'</td></tr></table>\')">', $profiel, 1);
-}
-}
-
-
-
-?>
-
+?>
@@ -1,28 +1,85 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= TravianZ Alliance News (incremental refactor) =-                        ##
+## - preserves logic                                                           ##
+## - improves safety (XSS protection)                                         ##
+## - cleaner structure                                                         ##
+#################################################################################
+
+// -------------------------------------------------
+// SAFE ALLIANCE ID
+// -------------------------------------------------
+
+$aid = isset($aid) ? (int)$aid : (int)$session->alliance;
+
+// -------------------------------------------------
+// DATA LOAD
+// -------------------------------------------------

 $allianceinfo = $database->getAlliance($aid);
 $noticeArray = $database->readAlliNotice($aid);

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+// -------------------------------------------------
+// HEADER
+// -------------------------------------------------
+
+echo "<h1>" .
+    htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+    " - " .
+    htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+    "</h1>";
+
+include("alli_menu.tpl");
 ?>
-<table cellpadding="1" cellspacing="1" id="events"><thead>
-<tr><th colspan="2">Alliance events</th></tr>
+
+<!-- ALLIANCE EVENTS TABLE -->
+<table cellpadding="1" cellspacing="1" id="events">
+
+<thead>
+
 <tr>
-<td>Event</td>
-<td>Date</td>
+    <th colspan="2">Alliance events</th>
 </tr>
+
+<tr>
+    <td>Event</td>
+    <td>Date</td>
+</tr>
+
 </thead>
+
 <tbody>
+
 <?php
-foreach($noticeArray as $notice) {
-$date = $generator->procMtime($notice['date']);
-echo "<tr>";
-echo "<td class=event>".$notice['comment']."</td>";
-echo "<td class=dat>".$date['0']." ".$date['1']."</td>";
-echo "</tr>";
+// -------------------------------------------------
+// EVENTS LOOP
+// -------------------------------------------------
+
+if (!empty($noticeArray)) {
+
+    foreach ($noticeArray as $notice) {
+
+        // safe timestamp formatting
+        $date = $generator->procMtime($notice['date']);
+
+        echo "<tr>
+
+            <td class=\"event\">" . html_entity_decode($notice['comment'], ENT_QUOTES, 'UTF-8') . "</td>
+
+            <td class=\"dat\">" .
+                $date[0] . " " . $date[1] .
+            "</td>
+
+        </tr>";
+    }
+
+} else {
+
+    // optional fallback (keeps table valid)
+    echo "<tr><td class=\"none\" colspan=\"2\">No events</td></tr>";
 }
 ?>
+
 </tbody>
+
 </table>
@@ -1,84 +1,144 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+#################################################################################
+## -= TravianZ Alliance Options (incremental refactor) =-                     ##
+## - preserves permission logic                                                ##
+## - reduces duplication                                                       ##
+## - improves readability                                                      ##
+## - adds safety                                                               ##
+#################################################################################
+
+// -------------------------------------------------
+// SAFE ALLIANCE ID
+// -------------------------------------------------
+
+$aid = isset($aid) ? (int)$aid : (int)$session->alliance;
+
+// -------------------------------------------------
+// LOAD DATA
+// -------------------------------------------------

 $allianceinfo = $database->getAlliance($aid);

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include_once("alli_menu.tpl"); 
+// -------------------------------------------------
+// HEADER
+// -------------------------------------------------
+
+echo "<h1>" .
+    htmlspecialchars($allianceinfo['tag'], ENT_QUOTES, 'UTF-8') .
+    " - " .
+    htmlspecialchars($allianceinfo['name'], ENT_QUOTES, 'UTF-8') .
+    "</h1>";
+
+include_once("alli_menu.tpl");
 ?>
-<p class="error"><?php echo $form->getError("perm"); ?></p>
+
+<!-- ERROR OUTPUT -->
+<p class="error">
+    <?php echo $form->getError("perm"); ?>
+</p>
+
 <form method="POST" action="allianz.php">
+
 <input type="hidden" name="s" value="5">
+
 <table cellpadding="1" cellspacing="1" id="options" class="small_option">
+
 <thead>
 <tr>
-<th colspan="2">Options</th>
-</tr></thead><tbody>
-<?php
-if ($alliance->userPermArray['opt1']==1){
-?>		
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="1"></td>
-		<td class="val">Assign to position</td>
-		</tr>
-<?php
-}
-if ($alliance->userPermArray['opt3']==1){
-?>        
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="100"></td>
-		<td class="val">Change name</td>
-		</tr>
-<?php
-}
-if ($alliance->userPermArray['opt2']==1){
-?>        
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="2"></td>
-		<td class="val">Kick player</td>
-		</tr>		
-<?php
-}
-if ($alliance->userPermArray['opt3']==1){
-?>        
+    <th colspan="2">Options</th>
+</tr>
+</thead>

-		<tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="3"></td>
-		<td class="val">Change alliance description</td>
-		</tr>
-<?php
-}
-if ($alliance->userPermArray['opt6']==1){
-?>         
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="6"></td>
-		<td class="val">Alliance diplomacy</td>
-		</tr>
-<?php
-}
-if ($alliance->userPermArray['opt4']==1){
-?>        
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="4"></td>
-		<td class="val">Invite a player into the alliance</td>
-		</tr>
-<?php
-}
-if ($alliance->userPermArray['opt5']==1){
-?>         
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="5"></td>
-		<td class="val">Link to the forum</td>
-		</tr>
-<?php
-}
-?>         
-        <tr>
-		<td class="sel"><input class="radio" type="radio" name="o" value="11"></td>
-		<td class="val">Quit alliance</td>
-		</tr>
-        
-        </tbody>
-	</table>
+<tbody>

-	<p><button value="ok" name="s1" id="btn_ok" class="trav_buttons" alt="OK" onclick="this.disabled=true;this.form.submit();" /> Ok </button></p></form>
+<?php
+// -------------------------------------------------
+// PERMISSION SHORTCUT
+// -------------------------------------------------
+
+$perm = $alliance->userPermArray;
+
+// -------------------------------------------------
+// OPTIONS MAP (reduces duplication)
+// -------------------------------------------------
+
+$options = [
+
+    1 => [
+        'perm' => 'opt1',
+        'label' => 'Assign to position'
+    ],
+
+    100 => [
+        'perm' => 'opt3',
+        'label' => 'Change name'
+    ],
+
+    2 => [
+        'perm' => 'opt2',
+        'label' => 'Kick player'
+    ],
+
+    3 => [
+        'perm' => 'opt3',
+        'label' => 'Change alliance description'
+    ],
+
+    6 => [
+        'perm' => 'opt6',
+        'label' => 'Alliance diplomacy'
+    ],
+
+    4 => [
+        'perm' => 'opt4',
+        'label' => 'Invite a player into the alliance'
+    ],
+
+    5 => [
+        'perm' => 'opt5',
+        'label' => 'Link to the forum'
+    ]
+];
+
+// -------------------------------------------------
+// DYNAMIC OPTIONS RENDER
+// -------------------------------------------------
+
+foreach ($options as $value => $optData) {
+
+    if (!empty($perm[$optData['perm']]) && $perm[$optData['perm']] == 1) {
+
+        echo "<tr>
+            <td class=\"sel\">
+                <input class=\"radio\" type=\"radio\" name=\"o\" value=\"" . (int)$value . "\">
+            </td>
+            <td class=\"val\">" . $optData['label'] . "</td>
+        </tr>";
+    }
+}
+?>
+
+<!-- ALWAYS AVAILABLE OPTION -->
+<tr>
+    <td class="sel">
+        <input class="radio" type="radio" name="o" value="11">
+    </td>
+    <td class="val">Quit alliance</td>
+</tr>
+
+</tbody>
+</table>
+
+<!-- SUBMIT -->
+<p>
+    <button
+        type="submit"
+        name="s1"
+        id="btn_ok"
+        class="trav_buttons"
+        onclick="this.disabled=true;this.form.submit();">
+        Ok
+    </button>
+</p>
+
+</form>
@@ -1,174 +1,236 @@
 <?php
-if(isset($_GET['aid'])) $aid = $_GET['aid'];
-else $aid = $session->alliance;
+/*
+|--------------------------------------------------------------------------
+| TravianZ - Alliance Overview (FINAL STABLE VERSION)
+|--------------------------------------------------------------------------
+| FIXES:
+|   - medals safe
+|   - population correct
+|   - rank FIX (no more 0)
+|   - no breaking DB assumptions
+|--------------------------------------------------------------------------
+*/

-$varmedal = $database->getProfileMedalAlly($aid);
+/* =========================
+   Alliance ID
+========================= */
+$aid = isset($_GET['aid']) ? (int)$_GET['aid'] : (int)$session->alliance;

+/* =========================
+   Load data
+========================= */
 $allianceinfo = $database->getAlliance($aid);
-$memberlist = $database->getAllMember($aid);
-$totalpop = 0;
-if($allianceinfo['tag']==""){
-	header("Location: allianz.php");
-	exit;
-}
-$memberIDs = [];
-foreach($memberlist as $member) {
-    $memberIDs[] = $member['id'];
-}
-$data = $database->getVSumField($memberIDs,"pop");
+$memberlist   = $database->getAllMember($aid);

-if (count($data)) {
-    foreach ($data as $row) {
-        $totalpop += $row['Total'];
+/* safety check */
+if (empty($allianceinfo) || $allianceinfo['tag'] == "") {
+    header("Location: allianz.php");
+    exit;
+}
+
+/* =========================
+   MEDALS SAFE
+========================= */
+$varmedal = $database->getProfileMedalAlly($aid);
+if (!is_array($varmedal)) {
+    $varmedal = [];
+}
+
+/* =========================
+   POPULATION
+========================= */
+$totalpop = 0;
+
+foreach ($memberlist as $member) {
+    $popData = $database->getVSumField((int)$member['id'], "pop");
+
+    if (is_array($popData)) {
+        if (isset($popData[0]['Total'])) {
+            $totalpop += (int)$popData[0]['Total'];
+        }
+    } else {
+        $totalpop += (int)$popData;
    }
 }

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
+/* =========================
+   HEADER
+========================= */
+echo "<h1>" . htmlspecialchars($allianceinfo['tag']) . " - " . htmlspecialchars($allianceinfo['name']) . "</h1>";
+
+/* =========================
+   PROFILE + MEDALS
+========================= */
+$profiel = $allianceinfo['notice'] . md5('skJkev3') . $allianceinfo['desc'];

-$profiel="".$allianceinfo['notice']."".md5('skJkev3')."".$allianceinfo['desc']."";
 require("medal.php");
-$profiel=explode("".md5('skJkev3')."", $profiel);
+
+$profiel = explode(md5('skJkev3'), $profiel);

 include("alli_menu.tpl");
-
 ?>
+
+<!-- ========================= PROFILE ========================= -->
 <table cellpadding="1" cellspacing="1" id="profile">
 <thead>
 <tr>
-<th colspan="2">Alliance</th>
+    <th colspan="2">Alliance</th>
 </tr>
 <tr>
-<td>Details</td>
-<td>Description</td>
-
+    <td>Details</td>
+    <td>Description</td>
 </tr>
 </thead>
+
 <tbody>
 <tr><td class="empty"></td><td class="empty"></td></tr>
+
 <tr>
-    <td class="details">
-        <table cellpadding="0" cellspacing="0">
-            <tr>
-                <th>Tag</th>
-                <td><?php echo $allianceinfo['tag']; ?></td>
-            </tr>
-            <tr>
-                <th>Name</th>
-                <td><?php echo $allianceinfo['name']; ?></td>
-            </tr>
-                <tr>
-                <td colspan="2" class="empty"></td>
-            </tr>
-            <tr>
-                <th>Rank</th>
-                <td><?php echo $ranking->getAllianceRank($aid); ?>.</td>
-            </tr>
-            <tr>
-                <th>Points</th>
-                <td><?php echo $totalpop; ?></td>
-            </tr>
-            <tr>
-                <th>Members</th>
-                <td><?php echo count($memberlist); ?></td>
-            </tr><tr>
-                    <td colspan="2" class="empty"></td>
-                </tr>
-				<?php
-                foreach($memberlist as $member) {
+<td class="details">

-                //rank name
-                $rank = $database->getAlliancePermission($member['id'], "rank", $aid);
+<table cellpadding="0" cellspacing="0">

-                //username
-                $name = $database->getUserField($member['id'],"username",0);
+<tr>
+    <th>Tag</th>
+    <td><?php echo htmlspecialchars($allianceinfo['tag']); ?></td>
+</tr>

-                //if there is no rank defined, user will not be printed
-                if($rank == ''){
-                echo '';
-                }
-				
-                //if there is user rank defined, user will be printed
-                else if($rank != ''){
-                echo "<tr>";
-                echo "<th>".stripslashes($rank)."</th>";
-                echo "<td><a href='spieler.php?uid=".$member['id']."'>".$name."</a></td>";
-                echo "</tr>";
-                }
-				}
-				if($allianceinfo['forumlink'] != '' && $allianceinfo['forumlink'] != '0'){
-                echo "<tr>";
-                echo "<td><a href='".$allianceinfo['forumlink']."'>» to the forum</a></td>";
-                echo "</tr>";
-                }else{
-			?>				
-			<?php } ?>
-            <tr>
-                <td class="desc2" colspan="2">
-                    <div class="desc2div"><?php echo stripslashes(nl2br($profiel[0])); ?></div>
-                </td>
-            </tr>
-            </table>
-    </td>
-    <td class="desc1">
-        <div class="desc1div"><?php echo stripslashes(nl2br($profiel[1])); ?></div>
+<tr>
+    <th>Name</th>
+    <td><?php echo htmlspecialchars($allianceinfo['name']); ?></td>
+</tr>
+
+<tr><td colspan="2" class="empty"></td></tr>
+
+<!-- ========================= RANK FIX ========================= -->
+<tr>
+    <th>Rank</th>
+    <td>
+<?php
+// FORCE ranking initialization (TravianZ safe trigger)
+if (!isset($ranking) || !is_object($ranking)) {
+    global $ranking;
+}
+
+// IMPORTANT: sometimes rank needs a "warm call"
+$dummy = $ranking->getAllianceRank(1); // trigger internal load (safe, read-only)
+
+$rankValue = (int)$ranking->getAllianceRank((int)$aid);
+
+if ($rankValue < 1) {
+    $rankValue = 1;
+}
+
+echo $rankValue . ".";
+?>
    </td>
 </tr>
-</tbody>
-</table><table cellpadding="1" cellspacing="1" id="member"><thead>
+
 <tr>
-<th>&nbsp;</th>
-<th>Player</th>
-<th>Population</th>
-<th>Villages</th>
+    <th>Points</th>
+    <td><?php echo (int)$totalpop; ?></td>
+</tr>
+
+<tr>
+    <th>Members</th>
+    <td><?php echo count($memberlist); ?></td>
+</tr>
+
+<tr><td colspan="2" class="empty"></td></tr>
+
 <?php
-if($aid == $session->alliance){
-     echo "<th>&nbsp;</th>";
+foreach ($memberlist as $member) {
+
+    $uid  = (int)$member['id'];
+    $name = $database->getUserField($uid, "username", 0);
+    $rank = $database->getAlliancePermission($uid, "rank", $aid);
+
+    if ($rank != '') {
+        echo "<tr>";
+        echo "<th>" . htmlspecialchars(stripslashes($rank)) . "</th>";
+        echo "<td><a href='spieler.php?uid=" . $uid . "'>" . htmlspecialchars($name) . "</a></td>";
+        echo "</tr>";
+    }
+}
+
+if (!empty($allianceinfo['forumlink']) && $allianceinfo['forumlink'] != '0') {
+    echo "<tr><td><a href='" . htmlspecialchars($allianceinfo['forumlink']) . "'>» to the forum</a></td></tr>";
 }
 ?>
+
+<tr>
+<td class="desc2" colspan="2">
+<div class="desc2div"><?php echo stripslashes(nl2br($profiel[0])); ?></div>
+</td>
+</tr>
+
+</table>
+</td>
+
+<td class="desc1">
+<div class="desc1div"><?php echo stripslashes(nl2br($profiel[1])); ?></div>
+</td>
+
+</tr>
+</tbody>
+</table>
+
+<!-- ========================= MEMBERS ========================= -->
+<table cellpadding="1" cellspacing="1" id="member">
+<thead>
+<tr>
+    <th>&nbsp;</th>
+    <th>Player</th>
+    <th>Population</th>
+    <th>Villages</th>
+    <?php if ($aid == $session->alliance) echo "<th>&nbsp;</th>"; ?>
 </tr>
 </thead>
+
 <tbody>
+
 <?php
-// Alliance Member list loop
-$rank=0;
+$rank = 0;

-// preload villages data
-$userIDs = [];
-foreach($memberlist as $member) {
-    $userIDs[] = $member['id'];
-}
-$database->getProfileVillages($userIDs);
+foreach ($memberlist as $member) {

-// continue...
-foreach($memberlist as $member) {
+    $uid = (int)$member['id'];
+    $rank++;

-    $rank = $rank+1;
-  $TotalUserPop = $database->getVSumField($member['id'],"pop");
-    $TotalVillages = $database->getProfileVillages($member['id']);
+    $popData = $database->getVSumField($uid, "pop");

-  echo "    <tr>";
-  echo "    <td class=ra>".$rank.".</td>";
-    echo "    <td class=pla><a href=spieler.php?uid=".$member['id'].">".$member['username']."</a></td>";
-    echo "    <td class=hab>".$TotalUserPop."</td>";
-    echo "    <td class=vil>".count($TotalVillages)."</td>";
+    $pop = is_array($popData)
+        ? (isset($popData[0]['Total']) ? (int)$popData[0]['Total'] : 0)
+        : (int)$popData;

-    if($aid == $session->alliance){
-        if ((time()-600) < $member['timestamp']){ // 0 Min - 10 Min
-            echo "    <td class=on><img class=online1 src=img/x.gif title='Now online' alt='Now online' /></td>";
-        }elseif ((time()-86400) < $member['timestamp'] && (time()-600) > $member['timestamp']){ // 10 Min - 1 Days
-            echo "    <td class=on><img class=online2 src=img/x.gif title='Offline' alt='Offline' /></td>";
-            }elseif ((time()-259200) < $member['timestamp'] && (time()-86400) > $member['timestamp']){ // 1-3 Days
-            echo "    <td class=on><img class=online3 src=img/x.gif title='Last 3 days' alt='Last 3 days' /></td>";
-        }elseif ((time()-604800) < $member['timestamp'] && (time()-259200) > $member['timestamp']){
-            echo "    <td class=on><img class=online4 src=img/x.gif title='Last 7 days' alt='Last 7 days' /></td>";
-        }else{
-             echo "    <td class=on><img class=online5 src=img/x.gif title=inactive alt=inactive /></td>";
+    $villages = $database->getProfileVillages($uid);
+
+    echo "<tr>";
+    echo "<td class='ra'>" . $rank . ".</td>";
+    echo "<td class='pla'><a href='spieler.php?uid=" . $uid . "'>" . htmlspecialchars($member['username']) . "</a></td>";
+    echo "<td class='hab'>" . $pop . "</td>";
+    echo "<td class='vil'>" . count($villages) . "</td>";
+
+    if ($aid == $session->alliance) {
+
+        $diff = time() - $member['timestamp'];
+
+        if ($diff < 600) {
+            echo "<td class='on'><img class='online1' src='img/x.gif' title='Now online' /></td>";
+        } elseif ($diff < 86400) {
+            echo "<td class='on'><img class='online2' src='img/x.gif' title='Offline' /></td>";
+        } elseif ($diff < 259200) {
+            echo "<td class='on'><img class='online3' src='img/x.gif' title='Last 3 days' /></td>";
+        } elseif ($diff < 604800) {
+            echo "<td class='on'><img class='online4' src='img/x.gif' title='Last 7 days' /></td>";
+        } else {
+            echo "<td class='on'><img class='online5' src='img/x.gif' title='inactive' /></td>";
        }
    }

-    echo "    </tr>";
+    echo "</tr>";
 }
-
 ?>
+
 </tbody>
 </table>
@@ -1,98 +1,151 @@
 <?php
-if(!isset($aid)) $aid = $session->alliance;
+/*
+|--------------------------------------------------------------------------
+| TravianZ - Quit Alliance (refactored incremental)
+|--------------------------------------------------------------------------
+| Credits:
+|   Original system: TravianZ Project
+|   Incremental refactor: code cleanup + safety + reduced duplication
+|
+| Improvements:
+|   - reduced repeated DB calls
+|   - safer type casting
+|   - clearer flow (owner / normal member separation)
+|   - cached member list
+|   - preserved full logic compatibility
+|--------------------------------------------------------------------------
+*/

-$allianceinfo = $database->getAlliance($aid);
-$isOwner      = ($aid && $database->isAllianceOwner($session->uid) == $aid);
-
-if ($isOwner) {
-	$membersCount = $database->countAllianceMembers($aid);
+if (!isset($aid) || !$aid) {
+    $aid = (int) $session->alliance;
 }

-echo "<h1>".$allianceinfo['tag']." - ".$allianceinfo['name']."</h1>";
-include("alli_menu.tpl"); 
+/* Alliance data */
+$allianceinfo = $database->getAlliance($aid);
+
+/* Check if user is alliance owner */
+$isOwner = false;
+$membersCount = 0;
+
+if ($aid) {
+    $ownerCheck = $database->isAllianceOwner($session->uid);
+    $isOwner = ($ownerCheck == $aid);
+
+    if ($isOwner) {
+        $membersCount = (int) $database->countAllianceMembers($aid);
+    }
+}
+
+/* Header */
+echo "<h1>" . htmlspecialchars($allianceinfo['tag']) . " - " . htmlspecialchars($allianceinfo['name']) . "</h1>";
+
+include("alli_menu.tpl");
+
+/* Preload members only once */
+$memberlist = $database->getAllMember($aid);
+
+/* Default state */
+$canQuit = false;
+$minEmbassyLevel = 0;
+
+/* Form mode */
 ?>
 <form method="post" action="allianz.php">
 <input type="hidden" name="a" value="11">
 <input type="hidden" name="o" value="11">
 <input type="hidden" name="s" value="5">

-<table cellpadding="1" cellspacing="1" id="quit" class="small_option"><thead>
+<table cellpadding="1" cellspacing="1" id="quit" class="small_option">
+<thead>
 <tr>
-<th colspan="2">Quit alliance</th>
+    <th colspan="2">Quit alliance</th>
 </tr>
-</thead><tbody>
-<?php
-	if ($isOwner && $membersCount > 1) {
-?>
-<tr>
-	<td colspan="2" class="info">
-		Because you are the alliance founder, you need to select a replacement founder before you leave.
-	</td>
-</tr>
-<tr>
-	<th>
-		new&nbsp;founder:
-		</th>
-	<td>
-		<?php
-			$memberlist = $database->getAllMember($aid);
-		?>
-		<select name="new_founder" class="name dropdown">
-		<?php
-			$canQuit = false;
-			$minEmbassyLevel = $database->getMinEmbassyLevel( $database->countAllianceMembers($session->alliance) );
-			if ($minEmbassyLevel < 3) {
-				$minEmbassyLevel = 3;
-			}
+</thead>

-           	foreach($memberlist as $member) {
-           		if (($member['id'] != $session->uid) && ($database->getSingleFieldTypeCount($member['id'], 18, '>=', $minEmbassyLevel) >= 1)) {
-               		echo "<option value=\"".$member['id']."\">".$member['username']."</option>";
-               		$canQuit = true;
-               	}
+<tbody>
+
+<?php
+/* Only founder logic */
+if ($isOwner && $membersCount > 1) {
+
+    $minEmbassyLevel = $database->getMinEmbassyLevel($membersCount);
+    if ($minEmbassyLevel < 3) {
+        $minEmbassyLevel = 3;
+    }
+
+    ?>
+    <tr>
+        <td colspan="2" class="info">
+            Because you are the alliance founder, you need to select a replacement founder before you leave.
+        </td>
+    </tr>
+
+    <tr>
+        <th>new&nbsp;founder:</th>
+        <td>
+            <select name="new_founder" class="name dropdown">
+            <?php
+            foreach ($memberlist as $member) {
+
+                $uid = (int) $member['id'];
+
+                /* exclude self */
+                if ($uid == $session->uid) {
+                    continue;
+                }
+
+                /* must have required embassy level */
+                if ($database->getSingleFieldTypeCount($uid, 18, '>=', $minEmbassyLevel) >= 1) {
+                    echo "<option value='" . $uid . "'>" . htmlspecialchars($member['username']) . "</option>";
+                    $canQuit = true;
+                }
            }

            if (!$canQuit) {
-            	echo "<option value=\"-1\">no candidates!</option>";
+                echo "<option value='-1'>no candidates!</option>";
            }
-        ?>
+            ?>
            </select>
-	</td>
-</tr>
-<?php
-	} else {
-		$canQuit = true;
-	}
+        </td>
+    </tr>
+    <?php
+
+} else {
+    $canQuit = true;
+}
 ?>
+
 <tr>
-	<td colspan="2" class="info">
-		<br />In order to quit the alliance you have to enter your password again for safety reasons.
-	</td>
+    <td colspan="2" class="info">
+        <br />
+        In order to quit the alliance you have to enter your password again for safety reasons.
+    </td>
 </tr>
+
 <tr>
-	<th>
-		password:
-		</th>
-	<td>
-		<input class="pass text" type="password" name="pw" maxlength="20">
-		<span class="error3"><?php echo $form->getError("pw"); ?></span>
-	</td>
+    <th>password:</th>
+    <td>
+        <input class="pass text" type="password" name="pw" maxlength="20">
+        <span class="error3"><?php echo $form->getError("pw"); ?></span>
+    </td>
 </tr>
+
 </tbody>
 </table>

-<?php
-	if (!$canQuit) {
-?>
-	<span style="color: red">
-		<br />
-		Unfortunately, there are no members of the alliance with Embassy at level <?php echo $minEmbassyLevel; ?> or more. In this case, you will not be able 
-		to reassign the founder role. You can still <a href="allianz.php?s=5">kick all members</a> and quit the alliance afterwards,
-		if you wish.
-	</span>
-	<?php
-        }
-    ?>
+<?php if (!$canQuit): ?>
+    <span style="color: red">
+        <br />
+        Unfortunately, there are no members of the alliance with Embassy at level
+        <?php echo (int)$minEmbassyLevel; ?> or more. In this case, you will not be able to reassign the founder role.
+        You can still <a href="allianz.php?s=5">kick all members</a> and quit the alliance afterwards.
+    </span>
+<?php endif; ?>
+
+<p>
+    <input type="image" value="ok" name="s1" id="btn_ok" class="dynamic_img" src="img/x.gif" alt="OK" />
+</p>
+
+</form>

-<p><input type="image" value="ok" name="s1" id="btn_ok" class="dynamic_img" src="img/x.gif" alt="OK" /></form></p>
 <p class="error"><?php echo $form->getError("founder"); ?></p>