Znote Acc - Problem with function checkNewNameForIllegal

[therrax]

Hi All.
My problem:
I am using ZnoteAcc (master) on tfs1.0
When I change my nick by shop (ticket) I can use all marks ( for example ó,ą,ć,ź,ż,@#$%)
for example - I can change my nick from Therrax to The%#$rax

Could You take a look and tell me why it doesn't work? :/

// CHANGE character name
if (!empty($_POST['change_name'])) {
    if (!Token::isValid($_POST['token'])) {
        exit();
    }
    $oldname = getValue($_POST['change_name']);
    $newname = getValue($_POST['newName']);
  

    // Check if user is online
    $player = false;
    if ($config['TFSVersion'] === 'TFS_10') {
        $player = mysql_select_single("SELECT `id`, `account_id` FROM `players` WHERE `name` = '$oldname'");
        $player['online'] = (user_is_online_10($player['id'])) ? 1 : 0;
    } else $player = mysql_select_single("SELECT `id`, `account_id`, `online` FROM `players` WHERE `name` = '$oldname'");
  
    // Check if player has bough ticket
    $order = mysql_select_single("SELECT `id`, `account_id` FROM `znote_shop_orders` WHERE `type`='4' AND `account_id`='".$player['account_id']."' LIMIT 1;");
    if ($order !== false) {
        //data_dump($order, array($player['account_id'], $session_user_id), "data");
        // Check if player and account matches
        if ($session_user_id == $player['account_id'] && $session_user_id == $order['account_id']) {
            // Check if new name is not occupied
            $exist = mysql_select_single("SELECT `id` FROM `players` WHERE `name`='$newname';");
            if (!$exist) {
                // Check if new name follow rules
                $newname = validate_name($newname);
                if ($newname !== false) {
                    $error = false;
                    // name restriction
                    $resname = explode(" ", $newname);
                    foreach($resname as $res) {
                        if(in_array(strtolower($res), $config['invalidNameTags'])) {
                            $error = true;
                        }
                        else if(strlen($res) == 1) {
                            $error = true;
                        }
                    }
                    // Check name for illegal characters.
                    function checkNewNameForIllegal($name) {
                        if (preg_match('#^[\0-9åäö&()+%/*$€é,.\'"-]*$#i', $name)) {
                            return true;
                        }
                        return false;
                    }
                    if (checkNewNameForIllegal($newname)) {
                        $error = true;
                        echo 'This name contains illegal characters.';
                    }
                    if ($error === false) {
                        // Change the name!
                        mysql_update("UPDATE `players` SET `name`='$newname' WHERE `id`='".$player['id']."' LIMIT 1;");
                        mysql_delete("DELETE FROM `znote_shop_orders` WHERE `id`='".$order['id']."' LIMIT 1;");
                    }
                } else echo "Name validation failed, use another name.";
            } else echo "The character name you wish to change to already exist.";
        } else echo "Failed to sync your account. :|";
    } else echo "Did not find any name change tickets, but them in our <a href='shop.php'>shop!</a>";
}
// end

 

[therrax]

Can anybody help me? :/