Cosmetic: rename function escape_string to EscapeString
This commit is contained in:
@@ -108,7 +108,7 @@ AccountOpResult AccountMgr::ChangeUsername(uint32 accid, std::string new_uname,
|
|||||||
normalizeString(new_passwd);
|
normalizeString(new_passwd);
|
||||||
|
|
||||||
std::string safe_new_uname = new_uname;
|
std::string safe_new_uname = new_uname;
|
||||||
LoginDatabase.escape_string(safe_new_uname);
|
LoginDatabase.EscapeString(safe_new_uname);
|
||||||
|
|
||||||
LoginDatabase.PExecute("UPDATE account SET v='0', s='0', username='%s', sha_pass_hash='%s' WHERE id='%d'", safe_new_uname.c_str(),
|
LoginDatabase.PExecute("UPDATE account SET v='0', s='0', username='%s', sha_pass_hash='%s' WHERE id='%d'", safe_new_uname.c_str(),
|
||||||
CalculateShaPassHash(new_uname, new_passwd).c_str(), accid);
|
CalculateShaPassHash(new_uname, new_passwd).c_str(), accid);
|
||||||
@@ -138,7 +138,7 @@ AccountOpResult AccountMgr::ChangePassword(uint32 accid, std::string new_passwd)
|
|||||||
|
|
||||||
uint32 AccountMgr::GetId(std::string username)
|
uint32 AccountMgr::GetId(std::string username)
|
||||||
{
|
{
|
||||||
LoginDatabase.escape_string(username);
|
LoginDatabase.EscapeString(username);
|
||||||
QueryResult result = LoginDatabase.PQuery("SELECT id FROM account WHERE username = '%s'", username.c_str());
|
QueryResult result = LoginDatabase.PQuery("SELECT id FROM account WHERE username = '%s'", username.c_str());
|
||||||
if (!result)
|
if (!result)
|
||||||
return 0;
|
return 0;
|
||||||
|
|||||||
@@ -67,7 +67,7 @@ void AddonMgr::LoadFromDB()
|
|||||||
void AddonMgr::SaveAddon(AddonInfo const& addon)
|
void AddonMgr::SaveAddon(AddonInfo const& addon)
|
||||||
{
|
{
|
||||||
std::string name = addon.Name;
|
std::string name = addon.Name;
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
CharacterDatabase.PExecute("INSERT INTO addons (name, crc) VALUES ('%s', %u)", name.c_str(), addon.CRC);
|
CharacterDatabase.PExecute("INSERT INTO addons (name, crc) VALUES ('%s', %u)", name.c_str(), addon.CRC);
|
||||||
|
|
||||||
SavedAddon newAddon(addon.Name, addon.CRC);
|
SavedAddon newAddon(addon.Name, addon.CRC);
|
||||||
|
|||||||
@@ -611,7 +611,7 @@ bool ChatHandler::HandleLookupPlayerIpCommand(const char* args)
|
|||||||
char* limit_str = strtok (NULL, " ");
|
char* limit_str = strtok (NULL, " ");
|
||||||
int32 limit = limit_str ? atoi (limit_str) : -1;
|
int32 limit = limit_str ? atoi (limit_str) : -1;
|
||||||
|
|
||||||
LoginDatabase.escape_string (ip);
|
LoginDatabase.EscapeString (ip);
|
||||||
|
|
||||||
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE last_ip = '%s'", ip.c_str ());
|
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE last_ip = '%s'", ip.c_str ());
|
||||||
|
|
||||||
@@ -630,7 +630,7 @@ bool ChatHandler::HandleLookupPlayerAccountCommand(const char* args)
|
|||||||
if (!AccountMgr::normalizeString (account))
|
if (!AccountMgr::normalizeString (account))
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
LoginDatabase.escape_string (account);
|
LoginDatabase.EscapeString (account);
|
||||||
|
|
||||||
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE username = '%s'", account.c_str ());
|
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE username = '%s'", account.c_str ());
|
||||||
|
|
||||||
@@ -647,7 +647,7 @@ bool ChatHandler::HandleLookupPlayerEmailCommand(const char* args)
|
|||||||
char* limit_str = strtok (NULL, " ");
|
char* limit_str = strtok (NULL, " ");
|
||||||
int32 limit = limit_str ? atoi (limit_str) : -1;
|
int32 limit = limit_str ? atoi (limit_str) : -1;
|
||||||
|
|
||||||
LoginDatabase.escape_string (email);
|
LoginDatabase.EscapeString (email);
|
||||||
|
|
||||||
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE email = '%s'", email.c_str ());
|
QueryResult result = LoginDatabase.PQuery ("SELECT id, username FROM account WHERE email = '%s'", email.c_str ());
|
||||||
|
|
||||||
|
|||||||
@@ -225,7 +225,7 @@ bool ChatHandler::HandleAddItemCommand(const char *args)
|
|||||||
if (citemName && citemName[0])
|
if (citemName && citemName[0])
|
||||||
{
|
{
|
||||||
std::string itemName = citemName+1;
|
std::string itemName = citemName+1;
|
||||||
WorldDatabase.escape_string(itemName);
|
WorldDatabase.EscapeString(itemName);
|
||||||
QueryResult result = WorldDatabase.PQuery("SELECT entry FROM item_template WHERE name = '%s'", itemName.c_str());
|
QueryResult result = WorldDatabase.PQuery("SELECT entry FROM item_template WHERE name = '%s'", itemName.c_str());
|
||||||
if (!result)
|
if (!result)
|
||||||
{
|
{
|
||||||
@@ -3184,7 +3184,7 @@ bool ChatHandler::HandleBanInfoIPCommand(const char *args)
|
|||||||
|
|
||||||
std::string IP = cIP;
|
std::string IP = cIP;
|
||||||
|
|
||||||
LoginDatabase.escape_string(IP);
|
LoginDatabase.EscapeString(IP);
|
||||||
QueryResult result = LoginDatabase.PQuery("SELECT ip, FROM_UNIXTIME(bandate), FROM_UNIXTIME(unbandate), unbandate-UNIX_TIMESTAMP(), banreason, bannedby, unbandate-bandate FROM ip_banned WHERE ip = '%s'", IP.c_str());
|
QueryResult result = LoginDatabase.PQuery("SELECT ip, FROM_UNIXTIME(bandate), FROM_UNIXTIME(unbandate), unbandate-UNIX_TIMESTAMP(), banreason, bannedby, unbandate-bandate FROM ip_banned WHERE ip = '%s'", IP.c_str());
|
||||||
if (!result)
|
if (!result)
|
||||||
{
|
{
|
||||||
@@ -3293,7 +3293,7 @@ bool ChatHandler::HandleBanListAccountCommand(const char *args)
|
|||||||
|
|
||||||
char* cFilter = strtok((char*)args, " ");
|
char* cFilter = strtok((char*)args, " ");
|
||||||
std::string filter = cFilter ? cFilter : "";
|
std::string filter = cFilter ? cFilter : "";
|
||||||
LoginDatabase.escape_string(filter);
|
LoginDatabase.EscapeString(filter);
|
||||||
|
|
||||||
QueryResult result;
|
QueryResult result;
|
||||||
|
|
||||||
@@ -3398,7 +3398,7 @@ bool ChatHandler::HandleBanListIPCommand(const char *args)
|
|||||||
|
|
||||||
char* cFilter = strtok((char*)args, " ");
|
char* cFilter = strtok((char*)args, " ");
|
||||||
std::string filter = cFilter ? cFilter : "";
|
std::string filter = cFilter ? cFilter : "";
|
||||||
LoginDatabase.escape_string(filter);
|
LoginDatabase.EscapeString(filter);
|
||||||
|
|
||||||
QueryResult result;
|
QueryResult result;
|
||||||
|
|
||||||
|
|||||||
@@ -384,7 +384,7 @@ void Pet::SavePetToDB(PetSaveMode mode)
|
|||||||
{
|
{
|
||||||
uint32 owner = GUID_LOPART(GetOwnerGUID());
|
uint32 owner = GUID_LOPART(GetOwnerGUID());
|
||||||
std::string name = m_name;
|
std::string name = m_name;
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
||||||
// remove current data
|
// remove current data
|
||||||
trans->PAppend("DELETE FROM character_pet WHERE owner = '%u' AND id = '%u'", owner, m_charmInfo->GetPetNumber());
|
trans->PAppend("DELETE FROM character_pet WHERE owner = '%u' AND id = '%u'", owner, m_charmInfo->GetPetNumber());
|
||||||
|
|||||||
@@ -18186,7 +18186,7 @@ void Player::SaveToDB()
|
|||||||
outDebugValues();
|
outDebugValues();
|
||||||
|
|
||||||
std::string sql_name = m_name;
|
std::string sql_name = m_name;
|
||||||
CharacterDatabase.escape_string(sql_name);
|
CharacterDatabase.EscapeString(sql_name);
|
||||||
|
|
||||||
std::ostringstream ss;
|
std::ostringstream ss;
|
||||||
ss << "REPLACE INTO characters (guid, account, name, race, class, gender, level, xp, money, playerBytes, playerBytes2, playerFlags, "
|
ss << "REPLACE INTO characters (guid, account, name, race, class, gender, level, xp, money, playerBytes, playerBytes2, playerFlags, "
|
||||||
|
|||||||
@@ -108,7 +108,7 @@ void PlayerSocial::SetFriendNote(uint32 friend_guid, std::string note)
|
|||||||
|
|
||||||
utf8truncate(note, 48); // DB and client size limitation
|
utf8truncate(note, 48); // DB and client size limitation
|
||||||
|
|
||||||
CharacterDatabase.escape_string(note);
|
CharacterDatabase.EscapeString(note);
|
||||||
CharacterDatabase.PExecute("UPDATE character_social SET note = '%s' WHERE guid = '%u' AND friend = '%u'", note.c_str(), GetPlayerGUID(), friend_guid);
|
CharacterDatabase.PExecute("UPDATE character_social SET note = '%s' WHERE guid = '%u' AND friend = '%u'", note.c_str(), GetPlayerGUID(), friend_guid);
|
||||||
m_playerSocialMap[friend_guid].Note = note;
|
m_playerSocialMap[friend_guid].Note = note;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -2002,7 +2002,7 @@ uint64 ObjectMgr::GetPlayerGUIDByName(std::string name) const
|
|||||||
{
|
{
|
||||||
uint64 guid = 0;
|
uint64 guid = 0;
|
||||||
|
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
|
|
||||||
// Player name safe to sending to DB (checked at login) and this function using
|
// Player name safe to sending to DB (checked at login) and this function using
|
||||||
QueryResult result = CharacterDatabase.PQuery("SELECT guid FROM characters WHERE name = '%s'", name.c_str());
|
QueryResult result = CharacterDatabase.PQuery("SELECT guid FROM characters WHERE name = '%s'", name.c_str());
|
||||||
|
|||||||
@@ -1158,7 +1158,7 @@ void WorldSession::HandleCharRenameOpcode(WorldPacket& recv_data)
|
|||||||
}
|
}
|
||||||
|
|
||||||
std::string escaped_newname = newname;
|
std::string escaped_newname = newname;
|
||||||
CharacterDatabase.escape_string(escaped_newname);
|
CharacterDatabase.EscapeString(escaped_newname);
|
||||||
|
|
||||||
// make sure that the character belongs to the current account, that rename at login is enabled
|
// make sure that the character belongs to the current account, that rename at login is enabled
|
||||||
// and that there is no character with the desired new name
|
// and that there is no character with the desired new name
|
||||||
@@ -1270,7 +1270,7 @@ void WorldSession::HandleSetPlayerDeclinedNames(WorldPacket& recv_data)
|
|||||||
}
|
}
|
||||||
|
|
||||||
for (int i = 0; i < MAX_DECLINED_NAME_CASES; ++i)
|
for (int i = 0; i < MAX_DECLINED_NAME_CASES; ++i)
|
||||||
CharacterDatabase.escape_string(declinedname.name[i]);
|
CharacterDatabase.EscapeString(declinedname.name[i]);
|
||||||
|
|
||||||
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
||||||
trans->PAppend("DELETE FROM character_declinedname WHERE guid = '%u'", GUID_LOPART(guid));
|
trans->PAppend("DELETE FROM character_declinedname WHERE guid = '%u'", GUID_LOPART(guid));
|
||||||
@@ -1431,7 +1431,7 @@ void WorldSession::HandleCharCustomize(WorldPacket& recv_data)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
CharacterDatabase.escape_string(newname);
|
CharacterDatabase.EscapeString(newname);
|
||||||
if (QueryResult result = CharacterDatabase.PQuery("SELECT name FROM characters WHERE guid ='%u'", GUID_LOPART(guid)))
|
if (QueryResult result = CharacterDatabase.PQuery("SELECT name FROM characters WHERE guid ='%u'", GUID_LOPART(guid)))
|
||||||
{
|
{
|
||||||
std::string oldname = result->Fetch()[0].GetString();
|
std::string oldname = result->Fetch()[0].GetString();
|
||||||
@@ -1654,7 +1654,7 @@ void WorldSession::HandleCharFactionOrRaceChange(WorldPacket& recv_data)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
CharacterDatabase.escape_string(newname);
|
CharacterDatabase.EscapeString(newname);
|
||||||
Player::Customize(guid, gender, skin, face, hairStyle, hairColor, facialHair);
|
Player::Customize(guid, gender, skin, face, hairStyle, hairColor, facialHair);
|
||||||
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
||||||
trans->PAppend("UPDATE `characters` SET name='%s', race='%u', at_login=at_login & ~ %u WHERE guid='%u'", newname.c_str(), race, used_loginFlag, lowGuid);
|
trans->PAppend("UPDATE `characters` SET name='%s', race='%u', at_login=at_login & ~ %u WHERE guid='%u'", newname.c_str(), race, used_loginFlag, lowGuid);
|
||||||
|
|||||||
@@ -599,7 +599,7 @@ void WorldSession::HandleGroupChangeSubGroupOpcode(WorldPacket & recv_data)
|
|||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
guid = sObjectMgr->GetPlayerGUIDByName(name.c_str());
|
guid = sObjectMgr->GetPlayerGUIDByName(name.c_str());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -553,7 +553,7 @@ void WorldSession::HandleAddFriendOpcode(WorldPacket & recv_data)
|
|||||||
if (!normalizePlayerName(friendName))
|
if (!normalizePlayerName(friendName))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
CharacterDatabase.escape_string(friendName); // prevent SQL injection - normal name don't must changed by this call
|
CharacterDatabase.EscapeString(friendName); // prevent SQL injection - normal name don't must changed by this call
|
||||||
|
|
||||||
sLog->outDebug(LOG_FILTER_NETWORKIO, "WORLD: %s asked to add friend : '%s'",
|
sLog->outDebug(LOG_FILTER_NETWORKIO, "WORLD: %s asked to add friend : '%s'",
|
||||||
GetPlayer()->GetName(), friendName.c_str());
|
GetPlayer()->GetName(), friendName.c_str());
|
||||||
@@ -642,7 +642,7 @@ void WorldSession::HandleAddIgnoreOpcode(WorldPacket & recv_data)
|
|||||||
if (!normalizePlayerName(IgnoreName))
|
if (!normalizePlayerName(IgnoreName))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
CharacterDatabase.escape_string(IgnoreName); // prevent SQL injection - normal name don't must changed by this call
|
CharacterDatabase.EscapeString(IgnoreName); // prevent SQL injection - normal name don't must changed by this call
|
||||||
|
|
||||||
sLog->outDebug(LOG_FILTER_NETWORKIO, "WORLD: %s asked to Ignore: '%s'",
|
sLog->outDebug(LOG_FILTER_NETWORKIO, "WORLD: %s asked to Ignore: '%s'",
|
||||||
GetPlayer()->GetName(), IgnoreName.c_str());
|
GetPlayer()->GetName(), IgnoreName.c_str());
|
||||||
@@ -728,8 +728,8 @@ void WorldSession::HandleBugOpcode(WorldPacket & recv_data)
|
|||||||
sLog->outDebug(LOG_FILTER_NETWORKIO, "%s", type.c_str());
|
sLog->outDebug(LOG_FILTER_NETWORKIO, "%s", type.c_str());
|
||||||
sLog->outDebug(LOG_FILTER_NETWORKIO, "%s", content.c_str());
|
sLog->outDebug(LOG_FILTER_NETWORKIO, "%s", content.c_str());
|
||||||
|
|
||||||
CharacterDatabase.escape_string(type);
|
CharacterDatabase.EscapeString(type);
|
||||||
CharacterDatabase.escape_string(content);
|
CharacterDatabase.EscapeString(content);
|
||||||
CharacterDatabase.PExecute ("INSERT INTO bugreport (type, content) VALUES('%s', '%s')", type.c_str(), content.c_str());
|
CharacterDatabase.PExecute ("INSERT INTO bugreport (type, content) VALUES('%s', '%s')", type.c_str(), content.c_str());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -643,13 +643,13 @@ void WorldSession::HandlePetRename(WorldPacket & recv_data)
|
|||||||
if (isdeclined)
|
if (isdeclined)
|
||||||
{
|
{
|
||||||
for (uint8 i = 0; i < MAX_DECLINED_NAME_CASES; ++i)
|
for (uint8 i = 0; i < MAX_DECLINED_NAME_CASES; ++i)
|
||||||
CharacterDatabase.escape_string(declinedname.name[i]);
|
CharacterDatabase.EscapeString(declinedname.name[i]);
|
||||||
trans->PAppend("DELETE FROM character_pet_declinedname WHERE owner = '%u' AND id = '%u'", _player->GetGUIDLow(), pet->GetCharmInfo()->GetPetNumber());
|
trans->PAppend("DELETE FROM character_pet_declinedname WHERE owner = '%u' AND id = '%u'", _player->GetGUIDLow(), pet->GetCharmInfo()->GetPetNumber());
|
||||||
trans->PAppend("INSERT INTO character_pet_declinedname (id, owner, genitive, dative, accusative, instrumental, prepositional) VALUES ('%u', '%u', '%s', '%s', '%s', '%s', '%s')",
|
trans->PAppend("INSERT INTO character_pet_declinedname (id, owner, genitive, dative, accusative, instrumental, prepositional) VALUES ('%u', '%u', '%s', '%s', '%s', '%s', '%s')",
|
||||||
pet->GetCharmInfo()->GetPetNumber(), _player->GetGUIDLow(), declinedname.name[0].c_str(), declinedname.name[1].c_str(), declinedname.name[2].c_str(), declinedname.name[3].c_str(), declinedname.name[4].c_str());
|
pet->GetCharmInfo()->GetPetNumber(), _player->GetGUIDLow(), declinedname.name[0].c_str(), declinedname.name[1].c_str(), declinedname.name[2].c_str(), declinedname.name[3].c_str(), declinedname.name[4].c_str());
|
||||||
}
|
}
|
||||||
|
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
trans->PAppend("UPDATE character_pet SET name = '%s', renamed = '1' WHERE owner = '%u' AND id = '%u'", name.c_str(), _player->GetGUIDLow(), pet->GetCharmInfo()->GetPetNumber());
|
trans->PAppend("UPDATE character_pet SET name = '%s', renamed = '1' WHERE owner = '%u' AND id = '%u'", name.c_str(), _player->GetGUIDLow(), pet->GetCharmInfo()->GetPetNumber());
|
||||||
CharacterDatabase.CommitTransaction(trans);
|
CharacterDatabase.CommitTransaction(trans);
|
||||||
|
|
||||||
|
|||||||
@@ -233,7 +233,7 @@ void WorldSession::HandlePetitionBuyOpcode(WorldPacket & recv_data)
|
|||||||
ssInvalidPetitionGUIDs << "'" << charter->GetGUIDLow() << "'";
|
ssInvalidPetitionGUIDs << "'" << charter->GetGUIDLow() << "'";
|
||||||
|
|
||||||
sLog->outDebug(LOG_FILTER_NETWORKIO, "Invalid petition GUIDs: %s", ssInvalidPetitionGUIDs.str().c_str());
|
sLog->outDebug(LOG_FILTER_NETWORKIO, "Invalid petition GUIDs: %s", ssInvalidPetitionGUIDs.str().c_str());
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
SQLTransaction trans = CharacterDatabase.BeginTransaction();
|
||||||
trans->PAppend("DELETE FROM petition WHERE petitionguid IN (%s)", ssInvalidPetitionGUIDs.str().c_str());
|
trans->PAppend("DELETE FROM petition WHERE petitionguid IN (%s)", ssInvalidPetitionGUIDs.str().c_str());
|
||||||
trans->PAppend("DELETE FROM petition_sign WHERE petitionguid IN (%s)", ssInvalidPetitionGUIDs.str().c_str());
|
trans->PAppend("DELETE FROM petition_sign WHERE petitionguid IN (%s)", ssInvalidPetitionGUIDs.str().c_str());
|
||||||
@@ -432,7 +432,7 @@ void WorldSession::HandlePetitionRenameOpcode(WorldPacket & recv_data)
|
|||||||
}
|
}
|
||||||
|
|
||||||
std::string db_newname = newname;
|
std::string db_newname = newname;
|
||||||
CharacterDatabase.escape_string(db_newname);
|
CharacterDatabase.EscapeString(db_newname);
|
||||||
CharacterDatabase.PExecute("UPDATE petition SET name = '%s' WHERE petitionguid = '%u'",
|
CharacterDatabase.PExecute("UPDATE petition SET name = '%s' WHERE petitionguid = '%u'",
|
||||||
db_newname.c_str(), GUID_LOPART(petitionguid));
|
db_newname.c_str(), GUID_LOPART(petitionguid));
|
||||||
|
|
||||||
|
|||||||
@@ -812,7 +812,7 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
|
|||||||
|
|
||||||
// Get the account information from the realmd database
|
// Get the account information from the realmd database
|
||||||
std::string safe_account = account; // Duplicate, else will screw the SHA hash verification below
|
std::string safe_account = account; // Duplicate, else will screw the SHA hash verification below
|
||||||
LoginDatabase.escape_string (safe_account);
|
LoginDatabase.EscapeString (safe_account);
|
||||||
// No SQL injection, username escaped.
|
// No SQL injection, username escaped.
|
||||||
|
|
||||||
QueryResult result =
|
QueryResult result =
|
||||||
@@ -978,7 +978,7 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
|
|||||||
|
|
||||||
// Update the last_ip in the database
|
// Update the last_ip in the database
|
||||||
// No SQL injection, username escaped.
|
// No SQL injection, username escaped.
|
||||||
LoginDatabase.escape_string (address);
|
LoginDatabase.EscapeString (address);
|
||||||
|
|
||||||
LoginDatabase.PExecute ("UPDATE account "
|
LoginDatabase.PExecute ("UPDATE account "
|
||||||
"SET last_ip = '%s' "
|
"SET last_ip = '%s' "
|
||||||
|
|||||||
@@ -206,7 +206,7 @@ std::string CreateDumpString(char const* tableName, QueryResult result)
|
|||||||
else ss << ", '";
|
else ss << ", '";
|
||||||
|
|
||||||
std::string s = fields[i].GetString();
|
std::string s = fields[i].GetString();
|
||||||
CharacterDatabase.escape_string(s);
|
CharacterDatabase.EscapeString(s);
|
||||||
ss << s;
|
ss << s;
|
||||||
|
|
||||||
ss << "'";
|
ss << "'";
|
||||||
@@ -411,7 +411,7 @@ DumpReturn PlayerDumpReader::LoadDump(const std::string& file, uint32 account, s
|
|||||||
|
|
||||||
if (ObjectMgr::CheckPlayerName(name, true) == CHAR_NAME_SUCCESS)
|
if (ObjectMgr::CheckPlayerName(name, true) == CHAR_NAME_SUCCESS)
|
||||||
{
|
{
|
||||||
CharacterDatabase.escape_string(name); // for safe, we use name only for sql quearies anyway
|
CharacterDatabase.EscapeString(name); // for safe, we use name only for sql quearies anyway
|
||||||
result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str());
|
result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str());
|
||||||
if (result)
|
if (result)
|
||||||
name = ""; // use the one from the dump
|
name = ""; // use the one from the dump
|
||||||
@@ -507,7 +507,7 @@ DumpReturn PlayerDumpReader::LoadDump(const std::string& file, uint32 account, s
|
|||||||
{
|
{
|
||||||
// check if the original name already exists
|
// check if the original name already exists
|
||||||
name = getnth(line, 3);
|
name = getnth(line, 3);
|
||||||
CharacterDatabase.escape_string(name);
|
CharacterDatabase.EscapeString(name);
|
||||||
|
|
||||||
result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str());
|
result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str());
|
||||||
if (result)
|
if (result)
|
||||||
|
|||||||
@@ -113,7 +113,7 @@ public:
|
|||||||
if (!guid)
|
if (!guid)
|
||||||
{
|
{
|
||||||
std::string name = pParam1;
|
std::string name = pParam1;
|
||||||
WorldDatabase.escape_string(name);
|
WorldDatabase.EscapeString(name);
|
||||||
whereClause << ", creature_template WHERE creature.id = creature_template.entry AND creature_template.name "_LIKE_" '" << name << "'";
|
whereClause << ", creature_template WHERE creature.id = creature_template.entry AND creature_template.name "_LIKE_" '" << name << "'";
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
|||||||
@@ -233,7 +233,7 @@ public:
|
|||||||
else
|
else
|
||||||
{
|
{
|
||||||
std::string name = cId;
|
std::string name = cId;
|
||||||
WorldDatabase.escape_string(name);
|
WorldDatabase.EscapeString(name);
|
||||||
result = WorldDatabase.PQuery(
|
result = WorldDatabase.PQuery(
|
||||||
"SELECT guid, id, position_x, position_y, position_z, orientation, map, phaseMask, (POW(position_x - %f, 2) + POW(position_y - %f, 2) + POW(position_z - %f, 2)) AS order_ "
|
"SELECT guid, id, position_x, position_y, position_z, orientation, map, phaseMask, (POW(position_x - %f, 2) + POW(position_y - %f, 2) + POW(position_z - %f, 2)) AS order_ "
|
||||||
"FROM gameobject, gameobject_template WHERE gameobject_template.entry = gameobject.id AND map = %i AND name "_LIKE_" "_CONCAT3_("'%%'", "'%s'", "'%%'")" ORDER BY order_ ASC LIMIT 1",
|
"FROM gameobject, gameobject_template WHERE gameobject_template.entry = gameobject.id AND map = %i AND name "_LIKE_" "_CONCAT3_("'%%'", "'%s'", "'%%'")" ORDER BY order_ ASC LIMIT 1",
|
||||||
|
|||||||
@@ -434,7 +434,7 @@ public:
|
|||||||
else
|
else
|
||||||
{
|
{
|
||||||
std::string arg_str_3 = arg_3;
|
std::string arg_str_3 = arg_3;
|
||||||
WorldDatabase.escape_string(arg_str_3);
|
WorldDatabase.EscapeString(arg_str_3);
|
||||||
WorldDatabase.PExecute("UPDATE waypoint_scripts SET %s='%s' WHERE guid='%u'",
|
WorldDatabase.PExecute("UPDATE waypoint_scripts SET %s='%s' WHERE guid='%u'",
|
||||||
arg_2, arg_str_3.c_str(), id);
|
arg_2, arg_str_3.c_str(), id);
|
||||||
}
|
}
|
||||||
@@ -619,7 +619,7 @@ public:
|
|||||||
{
|
{
|
||||||
// show_str check for present in list of correct values, no sql injection possible
|
// show_str check for present in list of correct values, no sql injection possible
|
||||||
std::string text2 = text;
|
std::string text2 = text;
|
||||||
WorldDatabase.escape_string(text2);
|
WorldDatabase.EscapeString(text2);
|
||||||
WorldDatabase.PExecute("UPDATE waypoint_data SET %s='%s' WHERE id='%u' AND point='%u'",
|
WorldDatabase.PExecute("UPDATE waypoint_data SET %s='%s' WHERE id='%u' AND point='%u'",
|
||||||
show_str, text2.c_str(), pathid, point);
|
show_str, text2.c_str(), pathid, point);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -408,13 +408,13 @@ class DatabaseWorkerPool
|
|||||||
}
|
}
|
||||||
|
|
||||||
//! Apply escape string'ing for current collation. (utf8)
|
//! Apply escape string'ing for current collation. (utf8)
|
||||||
void escape_string(std::string& str)
|
void EscapeString(std::string& str)
|
||||||
{
|
{
|
||||||
if (str.empty())
|
if (str.empty())
|
||||||
return;
|
return;
|
||||||
|
|
||||||
char* buf = new char[str.size()*2+1];
|
char* buf = new char[str.size()*2+1];
|
||||||
escape_string(buf, str.c_str(), str.size());
|
EscapeString(buf, str.c_str(), str.size());
|
||||||
str = buf;
|
str = buf;
|
||||||
delete[] buf;
|
delete[] buf;
|
||||||
}
|
}
|
||||||
@@ -441,7 +441,7 @@ class DatabaseWorkerPool
|
|||||||
}
|
}
|
||||||
|
|
||||||
private:
|
private:
|
||||||
unsigned long escape_string(char *to, const char *from, unsigned long length)
|
unsigned long EscapeString(char *to, const char *from, unsigned long length)
|
||||||
{
|
{
|
||||||
if (!to || !from || !length)
|
if (!to || !from || !length)
|
||||||
return 0;
|
return 0;
|
||||||
|
|||||||
@@ -364,7 +364,7 @@ void Log::outDB(LogTypes type, const char * str)
|
|||||||
std::string new_str(str);
|
std::string new_str(str);
|
||||||
if (new_str.empty())
|
if (new_str.empty())
|
||||||
return;
|
return;
|
||||||
LoginDatabase.escape_string(new_str);
|
LoginDatabase.EscapeString(new_str);
|
||||||
|
|
||||||
LoginDatabase.PExecute("INSERT INTO logs (time, realm, type, string) "
|
LoginDatabase.PExecute("INSERT INTO logs (time, realm, type, string) "
|
||||||
"VALUES (" UI64FMTD ", %u, %u, '%s');", uint64(time(0)), realm, type, new_str.c_str());
|
"VALUES (" UI64FMTD ", %u, %u, '%s');", uint64(time(0)), realm, type, new_str.c_str());
|
||||||
|
|||||||
@@ -177,7 +177,7 @@ int RASocket::check_access_level(const std::string& user)
|
|||||||
std::string safe_user = user;
|
std::string safe_user = user;
|
||||||
|
|
||||||
AccountMgr::normalizeString(safe_user);
|
AccountMgr::normalizeString(safe_user);
|
||||||
LoginDatabase.escape_string(safe_user);
|
LoginDatabase.EscapeString(safe_user);
|
||||||
|
|
||||||
QueryResult result = LoginDatabase.PQuery("SELECT a.id, aa.gmlevel, aa.RealmID FROM account a LEFT JOIN account_access aa ON (a.id = aa.id) WHERE a.username = '%s'", safe_user.c_str());
|
QueryResult result = LoginDatabase.PQuery("SELECT a.id, aa.gmlevel, aa.RealmID FROM account a LEFT JOIN account_access aa ON (a.id = aa.id) WHERE a.username = '%s'", safe_user.c_str());
|
||||||
|
|
||||||
@@ -207,11 +207,11 @@ int RASocket::check_password(const std::string& user, const std::string& pass)
|
|||||||
{
|
{
|
||||||
std::string safe_user = user;
|
std::string safe_user = user;
|
||||||
AccountMgr::normalizeString(safe_user);
|
AccountMgr::normalizeString(safe_user);
|
||||||
LoginDatabase.escape_string(safe_user);
|
LoginDatabase.EscapeString(safe_user);
|
||||||
|
|
||||||
std::string safe_pass = pass;
|
std::string safe_pass = pass;
|
||||||
AccountMgr::normalizeString(safe_pass);
|
AccountMgr::normalizeString(safe_pass);
|
||||||
LoginDatabase.escape_string(safe_pass);
|
LoginDatabase.EscapeString(safe_pass);
|
||||||
|
|
||||||
std::string hash = sAccountMgr->CalculateShaPassHash(safe_user, safe_pass);
|
std::string hash = sAccountMgr->CalculateShaPassHash(safe_user, safe_pass);
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user