Script itemshop buy

<div id="main_content_item">
    <div id="main_content_item_title">
      <p class="textstyle_main_content_item_title">ItemShop-Cumpara</p>
</div>

<center>
<?PHP

  if(isset($_SESSION['user_admin']) && checkInt($_SESSION['user_admin']) && $_SESSION['user_admin']>=0) {

    if(isset($_GET['id']) && checkInt($_GET['id'])) {

      $sqlCmd="SELECT vnum, preis, attrtype0, attrvalue0, attrtype1, attrvalue1, attrtype2, attrvalue2, attrtype3, attrvalue3, attrtype4, attrvalue4, attrtype5, attrvalue5, attrtype6, attrvalue6, socket0, socket1, socket2 FROM ".SQL_HP_DB.".is_items WHERE id='".$_GET['id']."' LIMIT 1";
      $sqlQry=mysql_query($sqlCmd,$sqlHp);
      if(mysql_num_rows($sqlQry)==1) {

        $getItem=mysql_fetch_object($sqlQry);
        if($_SESSION['user_coins']>=$getItem->preis) {

          $getGroesse = compareItems($getItem->vnum);
          $belPos = checkPos($_SESSION['user_id']);
          $possiblePos = findPos($belPos['islager'],$getGroesse['groesse']);
          if(!empty($possiblePos)) {

            $sqlCmd="UPDATE account.account SET coins=coins-".$getItem->preis." WHERE id='".$_SESSION['user_id']."' LIMIT 1";
            $sqlQry=mysql_query($sqlCmd,$sqlServ);
            $sqlLog="INSERT INTO ".SQL_HP_DB.".is_log (account_id,vnum,preis,zeitpunkt) VALUES ('".$_SESSION['user_id']."','".$getItem->vnum."','".$getItem->preis."','".$sqlZeit."')";
            $qryLog=mysql_query($sqlLog,$sqlHp);
            $sqlItem="INSERT INTO player.item
            (owner_id,window,pos,count,vnum,attrtype0, attrvalue0, attrtype1, attrvalue1, attrtype2, attrvalue2, attrtype3, attrvalue3, attrtype4, attrvalue4, attrtype5, attrvalue5, attrtype6, attrvalue6, socket0, socket1, socket2)
            VALUES
            ('".$_SESSION['user_id']."','MALL','".$possiblePos[0]."','1','".$getItem->vnum."','".$getItem->attrtype0."', '".$getItem->attrvalue0."', '".$getItem->attrtype1."', '".$getItem->attrvalue1."', '".$getItem->attrtype2."', '".$getItem->attrvalue2."', '".$getItem->attrtype3."', '".$getItem->attrvalue3."', '".$getItem->attrtype4."', '".$getItem->attrvalue4."', '".$getItem->attrtype5."', '".$getItem->attrvalue5."', '".$getItem->attrtype6."', '".$getItem->attrvalue6."', '".$getItem->socket0."', '".$getItem->socket1."', '".$getItem->socket2."')";
            $qryItem=mysql_query($sqlItem,$sqlServ) or die(mysql_error());
            echo'<center><font color="green"><br>Achizitionarea de succes!</font> <br><br>Dacă nu ati primit itemul dorit contactati un administrator!</center><br>';

          }
          else {
            echo'<font color="red"><br>Nu este suficient spatiu în depozit!<br></font>';
          }

        }
        else {
          echo'<center>
  <font color="red"><br>Achizitionarea a esuat!</font> <br><br> Îmi pare rău, dar nu aveti destule monede dragon!</center><br><br>';
        }
      }
      else {
        echo'<font color="red"><br>Obiectul specificat nu există!<br></font><br>';
      }
    }
    else {
      echo'<font color="red"><br>Acest lucru nu este un obiect valid!</font><br><br>';
    }
    echo'<p><a href="javascript:history.back()">înapoi</a></p>';
  }
  else {
    echo'<meta http-equiv="refresh" content="1; URL=index.php?s=nincsbelepve"> ';
  }
?>
</center>

<div style="clear: both"></div>
</div>
<div class="bottom"></div>