Servidor:SaveSQLInt(sqlid, table[], row[], value)
{
new query[128];
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = %i WHERE id = %i", table, row, value, sqlid);
mysql_pquery(sqlConnection, query);
return true;
}
Servidor:SaveSQLFloat(sqlid, table[], row[], Float:value)
{
new query[128];
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = %f WHERE id = %i", table, row, value, sqlid);
mysql_pquery(sqlConnection, query);
return true;
}
Servidor:SaveSQLString(sqlid, table[], row[], value[])
{
new query[128];
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = %s WHERE id = %i", table, row, value, sqlid);
mysql_pquery(sqlConnection, query);
return true;
}
SaveSQLFloat(0,"accounts","Antenastyle",2.00);
SaveSQLString(0, "table","Antenastyle", "String");
else if(strmatch(section, "name"))
{
if(sscanf(params, "s[10]s[40]", section, extra)) return SendClientMessage(playerid, COLOR_GRAD2, "USAGE: {FFFFFF}/edithouse name [Name]");
{
if(strlen(extra) < 3 || strlen(extra) > 39) return SendClientMessage(playerid, COLOR_ERROR, "ERROR: Name must be between 3 and 39 characters.");
HouseData[houseid][HouseName] = extra;
Delete3DTextLabel(HouseData[houseid][HouseLabel]);
if(HouseData[houseid][HouseOwnerSQL] != 0)
{
format(string2, sizeof(string2), "{FFCC00}%s\nID: {FFFFFF}%i", HouseData[houseid][HouseName], HouseData[houseid][HouseSQLId]);
}
else
{
format(string2, sizeof(string2), "{FFCC00}%s\nPrice: {FFFFFF}%i$\n{FFCC00}ID: {FFFFFF}%i", HouseData[houseid][HouseName], HouseData[houseid][HousePrice], HouseData[houseid][HouseSQLId]);
}
HouseData[houseid][HouseLabel] = Create3DTextLabel(string2, 0xFFFFFFFF, HouseData[houseid][HouseExterior][0], HouseData[houseid][HouseExterior][1], HouseData[houseid][HouseExterior][2], 10.0, 0, 1);
SaveSQLString(HouseData[houseid][HouseSQLId], "houses", "Name", HouseData[houseid][HouseName]);
SendClientMessage(playerid, COLOR_YELLOW, "INFO: Name edited:");
SendClientMessage(playerid, COLOR_WHITE, HouseData[houseid][HouseName]);
}
}
UPDATE %e SET %e = %s WHERE id = %i
UPDATE %e SET %e = '%s' WHERE id = %i
|
pawn Код:
pawn Код:
|
|
Tell me why u r escaping the table and row but not value?
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = %s WHERE id = %i", table, row, value, sqlid); |
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = '%e' WHERE id = %i", table, row, value, sqlid);
mysql_format(sqlConnection, query, sizeof(query), "UPDATE %e SET %e = %s WHERE id = %i", table, row, value, sqlid);
|
You're securing the table and row by using %e, but then you let the value go unsecured as a normal string, do this:
PHP код:
PHP код:
|