helbreath.co website
What it is
helbreath.co is the website and account portal of Helbreath Empire and Helbreath Millennium, a fan-run server project for Helbreath, the 2D isometric MMORPG from 2000. Players come to it to download the game, read the news and server status, check the drop list of each monster, the quests, the rules and the Abaddon event, and buy Coins in the cash shop through PayPal.
It is also where accounts look after themselves by email: password and account recovery, email verification, and character deletion through a link the game mails. Every page is in English and Spanish.
How it's built
Plain PHP with PDO over MySQL, working on two databases at once: the site's own tables and the game's accounts and characters. Prepared statements only, and visitor input escaped on output.
- A hand-written SMTP client: implicit TLS and STARTTLS, AUTH LOGIN / PLAIN, MIME attachments, dot-stuffing and a header-injection guard. Every mail the site sends goes through it.
- PayPal IPN: a notification is accepted only when PayPal answers VERIFIED, the amount, currency and receiver are checked, and each transaction is recorded once, so a repeated notification pays nothing. The Coins are credited inside a database transaction.
- The game's exception reporter uploads its reports here: GUID-named zips (the GUID is validated, so the name cannot leave its folder), MD5 checked, a per-IP hourly limit and a size cap.
- Account pages that leak nothing: recovery answers the same whether or not an account exists, with limits on mails and tries; deleting a character takes a click and only works while it is logged out and in no guild.
- Admin panel for the server state, the countdown and a small news CMS, with a lockout after wrong tries, CSRF tokens and a hardened session cookie.
- The same hosting rules written twice, for Apache and IIS: extensionless URLs and a host-preserving HTTPS redirect.
Why I made it
It is the site of my own game servers: I design, write, host and operate it, and I also run the Helbreath servers it serves. It went idle while the game was paused and came back with the servers in 2026.
Timeline
Built in 2017, idle from 2020, revived and rebuilt through 2026.
Technologies
- PHP
- MySQL