[PowerPC603]

Even if sscanf won't escape text entered by a player, when you use the variable's contents in a query, escape it using the %e identifier instead of %s inside mysql_format.

Something like this:

pawn Код:

if (sscanf(params, "s[25]", VariableFP[ playerid ] ))
{
    mysql_format(SQL_db, Query, sizeof(Query), "UPDATE playerdata SET VarFP = '%e' WHERE ID = '%i'", VariableFP[playerid], ID);
    mysql_tquery(SQL_db, Query, "", "");
    return 1;
}