[PHP] making a battle script

<?
session_start();

// lets tell the script that if the user is not logged in they cannot access
// the game, when the user is logging in, some variable should be
// set that they are logged in, a basic easy one is
// $_SESSION['loggedin']=1;
// and when they logout destroy the session, google is your friend.

if($_SESSION['loggedin']==0) { header("Location: login.php");exit; }

$userid=$_SESSION['userid']; //assuming you have sessions set
$id=$_GET['userid']; // assuming the url uses a GET function

$z=mysql_query("SELECT * FROM users WHERE userid='$userid'");
$x=mysql_fetch_array($z);

// Protect the admin, you.

if($_GET['userid'] == '1') {
print "You cannot attack the admin, i am all powerful"; die;
}

// Lets make sure they are not attacking themselves

if($_GET['userid'] == '$userid') {
print "You cannot attack yourself"; die;
}

if(isset($_GET['userid'])) {
$q=mysql_query("SELECT * FROM users WHERE userid='$id'");
$r=mysql_fetch_array($q);

// Set some variables

$offender=$x['name'];
$defender=$r['name'];
$offhealth=$x['health'];
$defhealth=$r['health'];
$offstat1=$x['stat1'];
$defstat1=$r['stat1'];
$offstat2=$x['stat2'];
$defstat2=$r['stat2'];

// Lets make sure the user isn't trying to kill a dead user
// Or trying to kill people even though they are dead

if($offhealth<1) {
print "You are dead, you cannot attack while dead, jerk."; die;
}

if($defhealth<1) {
print "This Player Is Dead"; die;
}

// Set a random factor so the most powerful is not always the winner

$offrand=rand(0,100);
$defrand=rand(0,100);
$rand=rand(100,999);

// Do some math

$offpower=($offstat1+$offstat2+$offrand);
$defpower=($defstat1+$defstat2+$defrand);

$offdamage=($defpower-$defrand/*3);
$defdamage=($offpower-$offrand/*3);

// This is where you let the user know what is going on
// Send them to a link
// attack.php?userid=$id&math=$rand
// Print the names and health of each user

if($offpower>$defpower){

// print the action that took place, defense lost health

mysql_query("UPDATE users SET health=health-'$defdamamge' WHERE userid='$id'"); }

if($offpower<$defpower){

// print the action that took place, offense lost health

mysql_query("UPDATE users SET health=health-'$offdamamge' WHERE userid='$userid'"); }

// when a player reaches 1 health or lower it will state the player is dead
// this script will need editing if stats are involved
// but this is a good start to get you on your way
}
?>