SHOP для amxbans gm 1.6

<?
ini_set("display_errors","1");
    $this->dane_strony['POD_NAZWA_STRONY'] = 'Продлить VIP';
    $this->dane_strony['BELKA'] = 'Продлить VIP';
    
    $flaga = 'bit';
    $flagi_dostepu = 'a';

    $id_serwera = 10;
    $days = 30;
    $time = time();
    $serwer_id = 10;
    
    $buy = new Buy($id_serwera, $flaga, $flagi_dostepu, $days, $time, $identyfikator);
    session_start();  
        if( isset ( $_POST['zakup'] ) )
    {

        $nick = mysql_real_escape_string($_POST['nick']);
        $sql2   = "SELECT * from `amx_amxadmins` where `username`='".$nick."' ";
        $query2 = mysql_query($sql2);
        
        # проверка капчи
        if($_POST['kapcha'] != $_SESSION['rand_code'])
        {
            $this->dane_strony['TRESC'] .= 'Код с картинки не совпадает!';
        }            
        elseif(mysql_num_rows($query2) == 0)
        {
            $this->dane_strony['TRESC'] .= 'Не верный Ник!';
        }
        else
        {
        
            $key = mysql_real_escape_string($_POST['key']);
            $sql   = "SELECT * from `keys` where `key`='".$key."' ";
            $query = mysql_query($sql);
            if(mysql_num_rows($query) == 0)
            {
                $this->dane_strony['TRESC'] .= '<font color="red">Не правельный ключ</font>';
            }            
            else
            {    
                $days = 30;
                $exp=($days<=0)?"30":"(`created`+(".($days * 86400)."))";
                mysql_query("UPDATE `amx_amxadmins` SET `access`='bit', `ashow`='1' ,`expired`=".$exp.",`days`=".$days." WHERE `username` = '$nick'");
                $this->dane_strony['TRESC'] .= 'Верный ключ, желаем удачи';
                mysql_query("DELETE FROM `keys` WHERE `key` = '$key'");
                            # Ищем ИД игрока
                $sql2   = mysql_query("SELECT id from `amx_amxadmins` where `username`=".$nick." ");
                $sql3   = ("SELECT * from `amx_amxadmins_servers` where `admin_id`=".$sql2." ");
                $server = $_POST['server'];
                $query3 = mysql_query($sql3);
                if(mysql_num_rows($query3) == 0)
                {    
                    # если ид в таблице нет-добавляем его
                mysql_query("INSERT INTO `amx_admins_servers` (`admin_id`, `server_id`, `custom_flags`, `use_static_bantime`) VALUES (".$sql2.", ".$server.", \'\', \'no\')");
                }
                # если ид есть, обновляем, согласно выбраному серверу.
                else
                {
            mysql_query("UPDATE `amx_admins_servers` (`admin_id`, `server_id`, `custom_flags`, `use_static_bantime`) VALUES (".$sql2.", ".$server.", \'\', \'no\') WERE 'server_id'=".$server." and `admin_id`=".$sql2."");
                }    
            }
                
        }
    }
        
        
        $sql = "SELECT `id`,`hostname` FROM `amx_serverinfo`";
    $query = mysql_query($sql);
    
    $this->dane_strony['TRESC'] .= '
    <form action="" method="post">
    <table><tr><td>Ваш ник </td><td><input type="text" name="nick"></td></tr>
    <tr><td>Код активации </td><td><input type="text" name="key"></td></tr><tr>
    ';
    $this->dane_strony['TRESC'] .= '<tr><td>Выберите сервер: </td><td><select name="server"> ';
    while($id_srv = mysql_fetch_array($query)){
        $this->dane_strony['TRESC'] .= '<option value="'.$id_srv["id"].'">'.$id_srv["hostname"];
    }
    $this->dane_strony['TRESC'] .='</select></td></tr>
    <tr><td></td><td><img src = "captcha.php" /></tr></td>
    <tr><td>Введите код с картинки </td><td><input type = "text" name = "kapcha" /></tr></td>
    <td><input type="submit" name="zakup" value="Продлить"></td></tr></table>
    </form>
    
    ';
?>"