STRING* character_creation_str="";
STRING* client_username_str="";
STRING* client_password_str="";
function create_character()
{
	character_creation = 1;
	str_cpy(character_creation_str,"op=7&user=");
	str_cat(character_creation_str,client_username_str);
	str_cat(character_creation_str,"&pass=");
	str_cat(character_creation_str,client_password_str);
	str_cat(character_creation_str,"&app=0000000000&pos=0000000x0000000x0000000");
	var createchar_http_id = http_sendpost("http://www.mesetts.com/game_req.php",character_creation_str);
	while (!http_status(createchar_http_id)) { wait(1); }	//wait for the server to reply
	if (http_status(createchar_http_id) == 1)					//transfer successful?
	{
		http_result(createchar_http_id,character_creation_str);	//get the replied IP
		if(str_cmp(character_creation_str,"41") == 1)
		{
			info_num = 13;
			str_cpy((info_txt.pstring)[0],"Character created!\nEntering game...");
			pan_controller(info_ok , SHOW_PAN);
		}
		else
		{
			info_num = 12;
			str_cpy((info_txt.pstring)[0],"Could not create. Please,\ncontact the administrator immediately!\nError code: ");
			str_cat((info_txt.pstring)[0],character_creation_str);
			pan_controller(info_ok , SHOW_PAN);
		}
	}
	else
	{
		info_num = 12;
		str_cpy((info_txt.pstring)[0],"Could not connect to database server.");
		pan_controller(info_ok , SHOW_PAN);
	}
	http_free(createchar_http_id);									//always cleanup the httpid!
}

if($operation == 7) {				// If register request
	if(isset($_GET['user'])) {		// If user received
		$user = $_GET['user'];		// Get it
	}
	else {
		echo '43';			// Else return 5 - no user posted
		return;
	}
	if(isset($_GET['pass'])) {		// If pass received
		$pass = $_GET['pass'];		// Get it
	}
	else {
		echo '44';			// Else return 6 - no pass posted
		return;
	}
	if(isset($_GET['app'])) {
		$app = $_GET['app'];
	}
	else {
		echo '48';
		return;
	}
	if(isset($_GET['pos'])) {
		$pos = $_GET['pos'];
	}
	else {
		echo '49';
		return;
	}

	$user = stripslashes($user);		// Strip slashes
	$pass = stripslashes($pass);
	$user = mysql_real_escape_string($user);	// Remove bad characters
	$pass = mysql_real_escape_string($pass);
	$app = stripslashes($app);
	$app = mysql_real_escape_string($app);
	$pos = stripslashes($pos);
	$pos = mysql_real_escape_string($pos);

	$mysqli_query_str="SELECT * FROM users WHERE nick='$user' and parola='$pass'";	// Prepare query
	$result=$mysqli->query($mysqli_query_str);					// Look for user

	// Mysql_num_row is counting table row
	$count=$result->num_rows;
	// If result matched $myusername and $mypassword, table row must be 1 row

	if($count==1){				// If match found
		$row = $result->fetch_assoc();
		if($row['character'] != null)
		{
			echo "46";		// Already present
			return;
		}
		else {
			$mysqli_query_str="INSERT INTO characters (appearance, position) VALUES('$app','$pos')";	// Prepare query
			$result=$mysqli->query($mysqli_query_str);							// Register user in database
			if($result) {
				$charid = $mysqli->insert_id;
				$mysqli_query_str='UPDATE users SET `character`="'.$charid.'" WHERE `nick`="'.$user.'" AND `parola`="'.$pass.'"';	// Prepare query
				$result=$mysqli->query($mysqli_query_str);							// Register user in database
				if($result) {
					echo "41";		// Success creating char and inserting
					//echo "<br />" . $charid . " | " . $result . "<br />" . $mysqli_query_str;
				}
				else {
					echo "40";		// Success creating/failed linking
					//echo "<br />" . $mysqli->error;
					return;
				}
			}
			else {
				echo "47";			// Failed creating
				return;
			}
		}
	}
	else {
		echo '45';			// Else - no user found / bad pass
		return;
	}
}

$user = stripslashes(mysql_real_escape_string($user));// Strip slashes & Remove bad characters
$pass = stripslashes(mysql_real_escape_string($pass));

....

$result=$mysqli->query("SELECT * FROM users WHERE nick='$user' and parola='$pass'");