1. SA-MP Forums Archive
  2. SA-MP Scripting and Plugins
  3. Scripting Help

Threaded Mode
Saving bankpassword in MySQL
Deroxi
Big Clucker
***
Posts: 97
Threads: 14
Joined: Apr 2015
Reputation: 0
#1

06.06.2016, 16:16
I tried to make a bank system all by myself. For now I only made the Register dialog, but whenever I try to register it won't save the password in the database
Code:
PHP код:
        case BankRegisterDialog:
        {
            if(Player[playerid][BankLogged] == 1)
            {
                if(strlen(inputtext) < 5)
                {
                      SendClientMessage(playerid, COLOR_RED, "[ERROR] You password must be longer than 5 characters!");
                    return ShowPlayerDialog(playerid, BankRegisterDialog, DIALOG_STYLE_PASSWORD, "Bank Password", "Enter your desired password below:", "Register", "Cancel");
                }
                new query[100], name[24], query2[100];
                GetPlayerName(playerid, name, 24);
                WP_Hash(Player[playerid][BankPassword], 129, inputtext);
                format(query, sizeof(query), "UPDATE 'accounts' SET 'Bankpassword' = '%s' WHERE 'Name' = '%s'", Player[playerid][BankPassword], name);
                mysql_query(mysql, query);
            }
        } 
Find
Reply
Konstantinos
Spam Machine
*****
Posts: 11,827
Threads: 33
Joined: Dec 2011
Reputation: 0
#2

06.06.2016, 16:23
The size of the query is 100 an and the output Whirlpool itself is 128 characters.

When a player registers, you need to use INSERT INTO as UPDATE is used for existed rows.

You better use threaded queries (even for INSERT/UPDATE/DELETE) and escape strings in the future.

Here's an example of register/login: https://raw.githubusercontent.com/pB...stem-cache.pwn

It also uses race condition check which not many of the tutorials/released gamemodes have.
Find
Reply
Deroxi
Big Clucker
***
Posts: 97
Threads: 14
Joined: Apr 2015
Reputation: 0
#3

06.06.2016, 16:46
PHP код:
format(query, sizeof(query), "INSERT INTO `accounts` (`Name`, `Bankpassword`) VALUES (`%e`, `%e`)", name, Player[playerid][BankPassword]); 
Didn't change anything, Im such a spoon in MySQL
Find
Reply
JasperM
Big Clucker
***
Posts: 183
Threads: 6
Joined: May 2014
Reputation: 0
#4

06.06.2016, 16:48
Besides the whole question, here is another quick note:

Just using Whirlpool once to hash a password without any kind of salt is not safe, at all. If your database gets breached, it wont take that long before someone has all bank passwords in plain text format. The easiest thing to change is to give every password a custom salt, which is added to the end of the password and then given to the WP_Hash function. This gives a bit of extra security, since rainbow tables become less useful. Second, use a function which is meant to be slow, like, for example, bcrypt. Googling "SAMP Bcrypt" should show up an include to use bcrypt. This is by far much safer than WP_Hash, because you can set it to be slower. This means that if your database is breached, and it already took your server 0.25 seconds to hash a password, an attacker needs a lot more time to get all the passwords.

TL; DR; 1. Hashing just passwords without a salt is unsafe. 2. Whirlpool is a relatively fast hashing mechanism which can't be set to be slower. Me and a lot of others recommend Bcrypt to solve this issue.
Find
Reply
Konstantinos
Spam Machine
*****
Posts: 11,827
Threads: 33
Joined: Dec 2011
Reputation: 0
#5

06.06.2016, 16:54
Quote:
Originally Posted by Deroxi
Посмотреть сообщение
PHP код:
format(query, sizeof(query), "INSERT INTO `accounts` (`Name`, `Bankpassword`) VALUES (`%e`, `%e`)", name, Player[playerid][BankPassword]); 
Didn't change anything, Im such a spoon in MySQL
Read your mysql_log.txt file, it should say more information on why the query failed.

I also agree with JasperM about adding a salt along with the hash so even if two or more users have the same password, they will have different hashed output. You can find more results on ****** but here's two threads from here:
https://sampforum.blast.hk/showthread.php?tid=350664
https://sampforum.blast.hk/showthread.php?tid=581336

Just to get an idea.
Find
Reply
Deroxi
Big Clucker
***
Posts: 97
Threads: 14
Joined: Apr 2015
Reputation: 0
#6

06.06.2016, 16:55
Quote:
Originally Posted by Konstantinos
Посмотреть сообщение
Read your mysql_log.txt file, it should say more information on why the query failed.

I also agree with JasperM about adding a salt along with the hash so even if two or more users have the same password, they will have different hashed output.
I will look at the log + I will take a look at the bcrypt, but that will probably be later on
EDIT:
Mysql_log.txt output:
[12:44:59] [WARNING] CMySQLHandle::Create - connection already exists
[12:45:02] [ERROR] cache_get_field_content_int - invalid datatype
Find
Reply
Konstantinos
Spam Machine
*****
Posts: 11,827
Threads: 33
Joined: Dec 2011
Reputation: 0
#7

06.06.2016, 17:02
About the cache function is that you are trying to retrieve data that is not integer. That also happens if the column is NULL.

For now, you'll need to enable log all so we can take a closer look at what is happening when you register.

before mysql_connect, call:
pawn Код:
mysql_log(LOG_ALL);
Try to register a new name and if it fails to insert a new row, post the mysql logs again.
Find
Reply
Deroxi
Big Clucker
***
Posts: 97
Threads: 14
Joined: Apr 2015
Reputation: 0
#8

06.06.2016, 17:09
PHP код:
[13:06:31] [DEBUG] mysql_connect - host: "localhost", user: "root", database: "samp", password: "****", port: 3306, autoreconnect: true, pool_size: 2
[13:06:31] [DEBUG] CMySQLHandle::Create - creating new connection..
[13:06:31] [WARNING] CMySQLHandle::Create - connection already exists
[13:06:31] [DEBUG] CMySQLConnection::Connect - establishing connection to database...
[13:06:31] [DEBUG] CMySQLConnection::Connect - connection was successful
[13:06:31] [DEBUG] CMySQLConnection::Connect - auto-reconnect has been enabled
[13:06:31] [DEBUG] mysql_errno - connection: 1
[13:06:31] [DEBUG] mysql_format - connection: 1, len: 128, format: "SELECT `Password`, `ID` FROM `accounts` WHERE `Name` = '%e' LIMIT 1"
[13:06:31] [DEBUG] mysql_tquery - connection: 1, query: "SELECT `Password`, `ID` FROM `accounts` WHERE `Name` = 'sorenkai", callback: "OnAccountCheck", format: "i"
[13:06:31] [DEBUG] CMySQLConnection::Connect - establishing connection to database...
[13:06:31] [DEBUG] CMySQLConnection::Connect - connection was successful
[13:06:31] [DEBUG] CMySQLConnection::Connect - auto-reconnect has been enabled
[13:06:31] [DEBUG] CMySQLConnection::Connect - establishing connection to database...
[13:06:31] [DEBUG] CMySQLConnection::Connect - connection was successful
[13:06:31] [DEBUG] CMySQLConnection::Connect - auto-reconnect has been enabled
[13:06:31] [DEBUG] CMySQLQuery::Execute[OnAccountCheck] - starting query execution
[13:06:31] [DEBUG] CMySQLQuery::Execute[OnAccountCheck] - query was successfully executed within 0.227 milliseconds
[13:06:31] [DEBUG] CMySQLResult::CMySQLResult() - constructor called
[13:06:31] [DEBUG] CMySQLConnection::Connect - establishing connection to database...
[13:06:31] [DEBUG] CMySQLConnection::Connect - connection was successful
[13:06:31] [DEBUG] CMySQLConnection::Connect - auto-reconnect has been enabled
[13:06:31] [DEBUG] Calling callback "OnAccountCheck"..
[13:06:31] [DEBUG] cache_get_data - connection: 1
[13:06:31] [DEBUG] cache_get_field_content - row: 0, field_name: "Password", connection: 1, max_len: 129
[13:06:31] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Password", data: "****"
[13:06:31] [DEBUG] cache_get_field_content_int - row: 0, field_name: "ID", connection: 1
[13:06:31] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "ID", data: "3"
[13:06:31] [DEBUG] CMySQLResult::~CMySQLResult() - deconstructor called
[13:06:36] [DEBUG] mysql_format - connection: 1, len: 100, format: "SELECT * FROM `accounts` WHERE `Name` = '%e' LIMIT 1"
[13:06:36] [DEBUG] mysql_tquery - connection: 1, query: "SELECT * FROM `accounts` WHERE `Name` = 'sorenkai' LIMIT 1", callback: "OnAccountLoad", format: "i"
[13:06:36] [DEBUG] CMySQLQuery::Execute[OnAccountLoad] - starting query execution
[13:06:36] [DEBUG] CMySQLQuery::Execute[OnAccountLoad] - query was successfully executed within 0.235 milliseconds
[13:06:36] [DEBUG] CMySQLResult::CMySQLResult() - constructor called
[13:06:36] [DEBUG] Calling callback "OnAccountLoad"..
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Score", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Score", data: "104"
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Admin", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Admin", data: "6"
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "VIP", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "VIP", data: "0"
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Money", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Money", data: "150229"
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Bankpassword", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Bankpassword", data: "0"
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Bankmoney", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Bankmoney", data: ""
[13:06:36] [ERROR] cache_get_field_content_int - invalid datatype
[13:06:36] [DEBUG] cache_get_field_content_int - row: 0, field_name: "Banklogged", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "Banklogged", data: "2"
[13:06:36] [DEBUG] cache_get_field_content_float - row: 0, field_name: "PosX", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "PosX", data: "2316.29"
[13:06:36] [DEBUG] cache_get_field_content_float - row: 0, field_name: "PosY", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "PosY", data: "-11.52"
[13:06:36] [DEBUG] cache_get_field_content_float - row: 0, field_name: "PosZ", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "PosZ", data: "26.742"
[13:06:36] [DEBUG] cache_get_field_content_float - row: 0, field_name: "PosA", connection: 1
[13:06:36] [DEBUG] CMySQLResult::GetRowDataByName - row: '0', field: "PosA", data: "182.048"
[13:06:36] [DEBUG] CMySQLResult::~CMySQLResult() - deconstructor called 
Find
Reply
Konstantinos
Spam Machine
*****
Posts: 11,827
Threads: 33
Joined: Dec 2011
Reputation: 0
#9

06.06.2016, 17:13
That's the loading part and it seems to work (at least that's what it shows, loading correct values).

The problem is with registering an account, isn't it? If so, you will have to connect with a name that does not exist to database so it forces you to register.
Find
Reply
Deroxi
Big Clucker
***
Posts: 97
Threads: 14
Joined: Apr 2015
Reputation: 0
#10

06.06.2016, 17:18
I'm not sure if you got this: I have made a login/register system (tutorial :3). And now I tried to make a Bank account system where you have to register/login with a password to access your bank account.
Find
Reply
« Next Oldest | Next Newest »


Forum Jump:


Users browsing this thread: 1 Guest(s)
  1. SA-MP Forums Archive
  2. SA-MP Scripting and Plugins
  3. Scripting Help