diff --git a/controllers/userController.js b/controllers/userController.js
index c41a7db..ee016b8 100644
--- a/controllers/userController.js
+++ b/controllers/userController.js
@@ -9,7 +9,7 @@ exports.getUser = function(req, res) {
 		{
 			'facebookId': req.params.id
 		},
-    '_id username facebookId level health health_limit agility appearance strength spritename stamina skillInUse',
+    '_id username facebookId level health agility appearance strength spritename stamina skillInUse experience healthLimit',
     function(err, user) {
 			if (err) {
 				return res.status(500).json({
@@ -28,18 +28,133 @@ exports.getUser = function(req, res) {
 	});
 };
 
-exports.updateUser = function(req, res) {
-	var query = { '_id': req.user._id };
-	User.findOneAndUpdate(query, req.body.newData, { upsert:true }, function(err, user) {
-			if (err) {
-				return res.status(500).json({
-				 	message: err.message
-				})
-			}
-			res.send({
-				status: "ok",
-			});
-	});
+exports.updateUserSpritename = function(req, res) {
+  var query = { '_id': req.user._id };
+  if (!req.body.spritename) {
+    res.send({
+      status: "error",
+      error: "Please input new spritename for update"
+    });
+  }
+  var updateAttributes = { "spritename":req.body.spritename }
+  User.findOneAndUpdate(query, updateAttributes, { upsert:true }, function(err, user) {
+      if (err) {
+        return res.status(500).json({
+          message: err.message
+        })
+      }
+      res.send({
+        status: "ok",
+      });
+  });
+}
+
+//(strength, stamina, agility, health, healthLimit)
+exports.updateUserAttributes = function(req, res) {
+  var query = { '_id': req.user._id };
+  var updateAttributes = {}
+  if (req.body.strength) {
+    updateAttributes['strength'] = req.body.strength
+  }
+  if (req.body.stamina) {
+    updateAttributes['stamina'] = req.body.stamina
+  }
+  if (req.body.agility) {
+    updateAttributes['agility'] = req.body.agility
+  }
+  if (req.body.health) {
+    updateAttributes['health'] = req.body.health
+  }
+  if (req.body.healthLimit) {
+    updateAttributes['healthLimit'] = req.body.healthLimit
+  }
+  if (!updateAttributes.strength && !updateAttributes.stamina && !updateAttributes.agility && !updateAttributes.health && !updateAttributes.healthLimit) {
+    res.send({
+      status: "error",
+      error: "Please input attributes for update"
+    });
+  }
+
+  User.findOneAndUpdate(query, updateAttributes, { upsert:true }, function(err, user) {
+      if (err) {
+        return res.status(500).json({
+          message: err.message
+        })
+      }
+      res.send({
+        status: "ok",
+      });
+  });
+}
+
+exports.updateUserSkills = function(req, res) {
+  var query = { '_id': req.user._id };
+  if (!req.body.skills) {
+    res.send({
+      status: "error",
+      error: "Please input skills in used for update"
+    });
+  }
+  var updateAttributes = { "skillInUse":req.body.skills }
+  User.findOneAndUpdate(query, updateAttributes, { upsert:true }, function(err, user) {
+      if (err) {
+        return res.status(500).json({
+          message: err.message
+        })
+      }
+      res.send({
+        status: "ok",
+      });
+  });
+}
+
+exports.updateUserAppearance = function(req, res) {
+  var query = { '_id': req.user._id };
+  if (!req.body.appearance) {
+    res.send({
+      status: "error",
+      error: "Please input appearance for update"
+    });
+  }
+  var updateAttributes = { "appearance":req.body.appearance }
+  User.findOneAndUpdate(query, updateAttributes, { upsert:true }, function(err, user) {
+      if (err) {
+        return res.status(500).json({
+          message: err.message
+        })
+      }
+      res.send({
+        status: "ok",
+      });
+  });
+}
+
+exports.updateUserLevelExperience = function(req, res) {
+  var query = { '_id': req.user._id };
+  var updateAttributes = {}
+  if (req.body.level) {
+    updateAttributes['level'] = req.body.level
+  }
+  if (req.body.experience) {
+    updateAttributes['experience'] = req.body.experience
+  }
+  if (!updateAttributes.level && !updateAttributes.experience) {
+    res.send({
+      status: "error",
+      error: "Please input level / experience for update"
+    });
+  }
+
+  User.findOneAndUpdate(query, updateAttributes, { upsert:true }, function(err, user) {
+      if (err) {
+        return res.status(500).json({
+          message: err.message
+        })
+      }
+      res.send({
+        status: "ok",
+      });
+  });
 }
 
 exports.getFriends = function(req, res) {
diff --git a/models/skill.js b/models/skill.js
index 6daf885..dcef714 100644
--- a/models/skill.js
+++ b/models/skill.js
@@ -5,6 +5,7 @@ var mongoose = require('mongoose');
 // Skill Schema
 var SkillSchema = new mongoose.Schema({
 	name: String,
+	unlockLevel: Number,
 	strengthFactor: Number,
 	staminaFactor: Number,
 	agilityFactor: Number
diff --git a/models/user.js b/models/user.js
index 6e8d731..a5dfadc 100644
--- a/models/user.js
+++ b/models/user.js
@@ -16,9 +16,9 @@ var UserSchema = new mongoose.Schema({
   agility: Number,
   health: Number,
   healthLimit: Number,
-  experience: Number,
+  experience: { type: Number, min: 0 },
   appearance: String,
-  level: Number,
+  level: { type: Number, min: 0 },
   skillInUse: [String],
   updatedAt: Date,
   createdAt: Date,
diff --git a/routes/routes.js b/routes/routes.js
index 74e7e81..014f2c3 100644
--- a/routes/routes.js
+++ b/routes/routes.js
@@ -28,15 +28,19 @@ router.get('/me', verifyToken, authCtrl.refreshToken, function(req, res) {
 router.get('/users/friends', verifyToken, authCtrl.refreshToken, userCtrl.getFriends);
 // Get user
 router.get('/users/:id', verifyToken, authCtrl.refreshToken, userCtrl.getUser);
-// Update user
-router.post('/users', verifyToken, authCtrl.refreshToken, userCtrl.updateUser);
+// Update user spritename
+router.post('/users/spritename', verifyToken, authCtrl.refreshToken, userCtrl.updateUserSpritename);
+// Update user mi attributes (strength, stamina, agility, health, healthLimit)
+router.post('/users/attributes', verifyToken, authCtrl.refreshToken, userCtrl.updateUserAttributes);
+// Update user skills is used in use
+router.post('/users/skills', verifyToken, authCtrl.refreshToken, userCtrl.updateUserSkills);
+// Update user appearance
+router.post('/users/appearance', verifyToken, authCtrl.refreshToken, userCtrl.updateUserAppearance);
+// Update user level and experience
+router.post('/users/level_experience', verifyToken, authCtrl.refreshToken, userCtrl.updateUserLevelExperience);
 // Add combat
 router.post('/combats/create', verifyToken, authCtrl.refreshToken, combatCtrl.createCombat);
 // Get combat
 router.get('/combats/:id', verifyToken, authCtrl.refreshToken, combatCtrl.getCombat);
-// Add combat
-router.post('/skills/create', verifyToken, authCtrl.refreshToken, skillCtrl.createSkill);
-// Add combat
-router.get('/skills/:id', verifyToken, authCtrl.refreshToken, skillCtrl.getSkill);
 
 module.exports = router;