[chunky]

You could check it for possible SQL Injections (they probably won't be that stupid but who knows) but I don't see another way of exploiting their system to get the steamkeys.