diff --git a/code2item.php b/code2item.php
index ab4fa67..6015c19 100644
--- a/code2item.php
+++ b/code2item.php
@@ -1,2 +1,54 @@
 <?php
 
+require 'required.php';
+require 'onlyloggedin.php';
+
+/**
+ * https://www.sitepoint.com/php-random-number-generator/
+ */
+class Random {
+
+    // random seed
+    private static $RSeed = 0;
+
+    // set seed
+    public static function seed($s = 0) {
+        self::$RSeed = abs(intval($s)) % 9999999 + 1;
+        self::num();
+    }
+
+    // generate random number
+    public static function num($min = 0, $max = 9999999) {
+        if (self::$RSeed == 0) {
+            self::seed(mt_rand());
+        }
+        self::$RSeed = (self::$RSeed * 125) % 2796203;
+        return self::$RSeed % ($max - $min + 1) + $min;
+    }
+
+}
+
+$origcode = $VARS['code'];
+
+if (is_empty($origcode)) {
+    sendError("Bad code!", true);
+}
+
+if ($database->has('claimedcodes', ["AND" => ['code' => $origcode, 'playeruuid' => $_SESSION['uuid']]])) {
+    sendError("You've already found this code!", true);
+}
+
+$codearray = str_split($origcode);
+
+$codeint = 0;
+foreach ($codearray as $chr) {
+    $codeint += ord($chr);
+}
+
+Random::seed($codeint);
+$itemcode = Random::num(1, 6);
+
+$database->insert('inventory', ['playeruuid' => $_SESSION['uuid'], 'itemid' => $itemcode]);
+$database->insert('claimedcodes', ['code' => $origcode, 'playeruuid' => $_SESSION['uuid']]);
+$itemname = $database->select('items', ['itemname'], ['itemid' => $itemcode])[0]['itemname'];
+sendOK($itemname);
diff --git a/database.mwb b/database.mwb
index 7d600ec..8cbd6af 100644
Binary files a/database.mwb and b/database.mwb differ
diff --git a/database.mwb.bak b/database.mwb.bak
index 7f12b5f..5136645 100644
Binary files a/database.mwb.bak and b/database.mwb.bak differ
diff --git a/inventory.php b/inventory.php
index e7fbb86..47dafde 100644
--- a/inventory.php
+++ b/inventory.php
@@ -2,12 +2,28 @@
 
 require 'required.php';
 
+require 'onlyloggedin.php';
+
 if (is_empty($VARS['user'])) {
     sendError("Missing data.", true);
 }
 
-$inv = $database->select('items', ['[>]inventory' => ['itemid' => 'itemid'], '[>]itemclasses' => ['classid', 'classid']], ['inventory.itemuuid', 'inventory.itemid', 'inventory.itemjson', 'items.itemname', 'items.itemdesc', 'itemclasses.classid', 'itemclasses.classname'], ['inventory.playeruuid' => file_get_contents("https://sso.netsyms.com/api/getguid.php?user=" . $VARS['user'])]);
+$inv = $database->select(
+        'items', [
+    '[>]inventory' => ['itemid' => 'itemid'],
+    '[>]itemclasses' => ['classid', 'classid']
+        ], [
+    'inventory.itemuuid',
+    'inventory.itemid',
+    'inventory.itemjson',
+    'items.itemname',
+    'items.itemdesc',
+    'items.itemcode',
+    'itemclasses.classid',
+    'itemclasses.classname'
+        ], ['inventory.playeruuid' => $_SESSION['uuid']]
+);
 
 $out['status'] = 'OK';
 $out['items'] = $inv;
-echo json_encode($out);
\ No newline at end of file
+echo json_encode($out);
diff --git a/useitem.php b/useitem.php
new file mode 100644
index 0000000..00353d5
--- /dev/null
+++ b/useitem.php
@@ -0,0 +1,52 @@
+<?php
+
+require 'required.php';
+require 'onlyloggedin.php';
+
+$itemuuid = $VARS['itemuuid'];
+
+if (is_empty($itemuuid) || !is_numeric($itemuuid) || !$database->has('inventory', ["AND" => ['itemuuid' => $itemuuid, 'playeruuid' => $_SESSION['uuid']]])) {
+    sendError("Invalid itemuuid.", true);
+}
+
+$item = $database->select(
+                'items', [
+            '[>]inventory' => ['itemid' => 'itemid'],
+            '[>]itemclasses' => ['classid', 'classid']
+                ], [
+            'inventory.itemuuid',
+            'inventory.itemid',
+            'inventory.itemjson',
+            'items.itemname',
+            'items.itemcode',
+            'itemclasses.classid',
+            'itemclasses.classname'
+                ], [
+            "AND" => [
+                'itemuuid' => $itemuuid,
+                'playeruuid' => $_SESSION['uuid']
+            ]
+                ]
+        )[0];
+
+$player = $database->select('players', ['energy', 'maxenergy'], ['uuid' => $_SESSION['uuid']])[0];
+
+
+$item['itemcode'] = json_decode($item['itemcode'], true);
+switch ($item['classname']) {
+    case "healmagic":
+        // Only use item if it will do something
+        if ($player['energy'] < $player['maxenergy']) {
+            $newhp = $player['energy'] + $item['itemcode']['amount'];
+            if ($newhp > $player['maxenergy']) {
+                $newhp = $player['maxenergy'];
+            }
+            $database->update('players', ['energy' => $newhp], ['uuid' => $_SESSION['uuid']]);
+            if ($item['itemcode']['uses'] == 1) {
+                $database->delete('inventory', ["AND" => ['itemuuid' => $itemuuid, 'playeruuid' => $_SESSION['uuid']]]);
+            }
+        }
+        break;
+}
+sendOK();
+//echo json_encode($item);
\ No newline at end of file