[jamal1992]

I have this code in a dialog:

PHP код:

mysql_format(handle, string, sizeof(string), "UPDATE clans SET ClanRankName7 = '%s' WHERE ClanID = '%d'",inputtext,PlayerInfo[playerid][pClan]);
                mysql_query(handle, string); 


And receiving this error, but i don`t know why, the database has updated but he getting this error mysql log.

PHP код:

[ERROR] CMySQLQuery::Execute - (error #1064) You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Clan Owner'.')' at line 1
Clan Owner - inputtext 


[Vince]

Now enter this in the dialog and watch your table go to shit:

Код:

Clan Owner' --

Never use plain inputtext. Use %e to escape.

Plus, look up database normalization. If you need to add a number to a column name then you're doing databases wrong.

[jamal1992]

How to use "%e" man ? I think the problem comes from ClanRankName7 - this 7

[amirm3hdi]

DUDE, check out sql injections,
Go to the wiki and see how to use %e.

[jamal1992]

Quote:

Originally Posted by amirm3hdi DUDE, check out sql injections, Go to the wiki and see how to use %e.

I did it but i don`t understant where is the problem, look here is same thing:

PHP код:

mysql_format(handle, string, sizeof(string), "UPDATE clans SET ClanTag = '%s' WHERE clans.ClanID = '%d'",inputtext,PlayerInfo[playerid][pClan]);
                mysql_query(handle, string); 


PHP код:

[23:23:13] [ERROR] CMySQLQuery::Execute - (error #1064) You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'JA'.')' at line 1 


[AmigaBlizzard]

Replace the "%s" by "%e" for automatic escaping during formatting, that's all.

PHP код:

mysql_format(handle, string, sizeof(string), "UPDATE clans SET ClanTag = '%e' WHERE clans.ClanID = '%d'",inputtext,PlayerInfo[playerid][pClan]); 


Doesn't your error-log display the full query as it's sent to mysql?
Maybe your string is too short and doesn't contain the full query.
Show the length of "string", as well as the query as it's sent to mysql, which should be inside the error-log file.

This page shows some guidelines to track down error 1064 in mysql:
http://www.inmotionhosting.com/suppo...ing/error-1064

But since your error-line already displays

PHP код:

syntax to use near 'JA'.')' at line 1 


And this part isn't in your query, we can assume your players are entering text like

PHP код:

JA'. 


As clantag.
Because you didn't escape your inputted text, your players can really mess up your tables.
Just replacing the %s by %e can fix your errors already.

I hope they don't figure out that if they just do:

PHP код:

'; DROP TABLE clans; ' 


Your entire table, along with all it's data and complete data-structure is just gone.

Query:

PHP код:

UPDATE clans SET ClanTag = '%s' WHERE clans.ClanID = '%d' 


Replace the "%s" by the inputted text above (the DROP TABLE line) and you get this query:

PHP код:

UPDATE clans SET ClanTag = ''; DROP TABLE clans; '' WHERE clans.ClanID = '%d' 


The first part (before the first ; ) would just update the ClanTag for all clans in that table to an empty string: UPDATE clans SET ClanTag = '';
The ; ends the first query.
Then the second query "DROP TABLE clans" is executed.
The third part (after the second ; ) just fails because the query is incomplete (it's only a where clause without anything else).

You see what 1 player can do with your entire database?
He can just wipe it all, without any hacks on his end.

Anywhere you allow player-input to be saved into your table directly, use %e instead of %s to escape inputted text and be safe from mysql injections.

[jamal1992]

I tried a lot of things but no solution. Included in a command it works fine, just on dialog get error.

PHP код:

new tagname[10];
                format(tagname, 10, "%s",inputtext);
                mysql_format(handle, string, sizeof(string), "UPDATE clans SET ClanTag = '%e' WHERE clans.ClanID = '%d'",tagname,PlayerInfo[playerid][pClan]);
                mysql_query(handle, string); 


[jamal1992]

Bump