if ($func=="transfer_money")
{
    if ($code=="")
    {
     $templateform = loadtemplate("shop_transfer_money_1");
     eval(template);
     $output = $templateform;
     print_and_exit();
    } elseif ($code=="send")
    {
     global $HTTP_POST_VARS,$ibforums;
     if (!isset($HTTP_POST_VARS["money"]) OR !is_numeric($HTTP_POST_VARS["money"]) OR $HTTP_POST_VARS["money"]<=0)
     {
         shoperror("Sorry, you can't send 0 {$ibforums->vars["shop_currencyname"]}, or a negative amount, nice try though!");
     }
     if ($HTTP_POST_VARS["money"] > $ibforums->member["points"])
     {
         shoperror("You do not have enough {$ibforums->vars["shop_currencyname"]} to send " . currencyformat($HTTP_POST_VARS["money"]));
     }
    
     $money = $HTTP_POST_VARS["money"];

     if (!isset($HTTP_POST_VARS["username"]))
     {
         shoperror("You must enter a member to send {$ibforums->vars["shop_currencyname"]} to!");
     }
     $username = addslashes($HTTP_POST_VARS["username"]);
     $DB->query("SELECT id FROM _ipb_members WHERE name='{$username}' LIMIT 1");
     if ($DB->get_num_rows()==0)
     {
         shoperror("Recipient does not exist, correct spelling?");
     }
     $id = $DB->fetch_row();
     $id = $id["id"];
    
     $DB->query("UPDATE _ipb_members SET points = points + {$money} WHERE id={$id} LIMIT 1");
     $DB->query("UPDATE _ipb_members SET points = points - {$money} WHERE id={$ibforums->member["id"]} LIMIT 1");
        
        shop_addlog(array("type" => "M", "targetmemberid" => $id, "actiontext" => "Transfered {$money} {$ibforums->vars["shop_currencyname"]}" ));
        
        $post = "";
        if (isset($HTTP_POST_VARS["post"]))
        {
            $message = htmlspecialchars($HTTP_POST_VARS["post"]);
        }
        
        $recipient = $username;
        $sender = $ibforums->member["name"];
        global $std;
        $timestamp = $std->get_date(time(), "LONG");
        $servicebotname = $ibforums->vars["shop_botname"];
        $currencyname = $ibforums->vars["shop_currencyname"];
        $currency = currencyformat($money);
        
        $templateform = loadtemplate("transfer_money_pm");
        eval(template);
        $pm = $templateform;
        unset($templateform);
        global $std; $pm = $std->clean_value($pm);

        send_pm(array("recipientid" => $id, "title" => "{$ibforums->member["name"]} has sent you some {$ibforums->vars["shop_currencyname"]}", "message" => $pm, "senderid" => $ibforums->member["id"]));
        redirect("{$currency} sent to {$recipient}", "act=shop");
        exit;
    }
    else    
    {
     shoperror("Contact your board administrator and ask to be banned... no messing with board input :P");
    }
    
}

<form name="transfer" method="post" action="<!!URL>&func=transfer_money&code=send">

<table width="100%" border="0" cellspacing="1" cellpadding="4">
<tr>
<td class='titlemedium' colspan="2">Send <@ibforums->vars["shop_currencyname"]@></td>
</tr>
<tr>
<td class="postfoot" colspan="2">Recipient</td>
</tr>
<tr>
<td class="row1" align="right">Send <@ibforums->vars["shop_currencyname"]@> to:</td>
<td class="row2">

//Tutaj powinien sie wpisywac user
<input type="textbox" class='forminput' name="username" value=''>
///Tutaj

</td>
</tr>

<tr>
<td class="postfoot" colspan="2">Amount of <@ibforums->vars["shop_currencyname"]@></td>
</tr>

<tr>
<td class="row1" align="right"><@ibforums->vars["shop_currencyname"]@>:</td>
<td class="row2"><input type="textbox" class='forminput' name="money" value=""></td>
</tr>

<tr>
<td class="postfoot" colspan="2">Attached Message - included in recipient's PM reciept</td>
</tr>


<tr>
<td class="row1" colspan="2"><textarea name="post" cols="50" rows="6"> </text-area>
</td></tr>

<tr>
<td class='mainfoot' align="center" colspan="2"><input type="submit" name="submit" value="Send Money" tabindex='4' class='forminput' accesskey='s'>
</td></tr>
</table>

<?php echo $_GET['user']; ?>