[Misiur]

Code:

mysql_format(dbHandle, medquery, sizeof medquery, "SELECT * FROM playerobjects \
                JOIN objects ON playerobjects.O_ObjectID = objects.ID WHERE playerobjects.PlayerObjectStatus = 3 OR playerobjects.PlayerObjectStatus = 4");

If query doesn't contain a single parameter, you can simply pass it to mysql_query. Think of format + SendClientMessage (just with additional %e).

Code:

mysql_format(dbHandle, query, sizeof query, "SELECT * FROM objects WHERE Name LIKE('%%%e%%') LIMIT 0,1",Obj);

You might consider additional escaping of Obj string, prefixing LIKE wildcards % and _ with backslash.

/remaction is vunerable to sqli

Quote:

/remaction a' or '1'='1

results in

Quote:

DELETE FROM actions WHERE Action = 'a' or '1'='1'

Code:

if(sscanf(params,"s[32]", id))

Using sscanf to fetch single string is unnecessary, use

Code:

if(isnull(params))

Then params instead id.

Default JOIN is INNER JOIN in mysql engine. Please specify type of join you want, because in most cases it should be LEFT JOIN.

Overall nice system, I like it.

P.S. I hate you forever and ever for raven's rp.