[Toni]

I was just wondering, what are the benefits?
I might be trying to switch to a MySQL Database, but before I do, I just wanted to know what are the benefits, and problems that could happen?

[[HiC]TheKiller]

You can make it so there is a website with a admin panel, stats etc. It's better to hold large amounts of information. A problem is, you could be SQL injected and someone hacks into your DB or destroys it.

[Chaprnks]

Ability to easily connect and read information from an external source, and some functions that would be almost impossible with file base (ex: check all accounts column). A SQL injection is possible, but its pretty unheard of in the SA-MP community, I'd just be cautious when you use it on the website.

[Scenario]

Hm, I am implementing MySQL into my new GM, but I have stopped completely until I get my Raven's Role Play script to a point where it will work for now... Anyways, like stated above it is better at handling/holding large amounts of data, like player files. You can use an online Admin Panel, if you create one and I believe its a bit safer. Now, of course injections may cause a bit of a problem, but if you have a good enough password/firewall, you should be okay.

[Sergei]

Quote:

Originally Posted by [HiC]TheKiller You can make it so there is a website with a admin panel, stats etc. It's better to hold large amounts of information. A problem is, you could be SQL injected and someone hacks into your DB or destroys it.

With SA:MP the only way to be SQL injected is if you don't escape strings before inserting them into query. If you do that, you are good to go.

[Toni]

Quote:

Originally Posted by Sergei With SA:MP the only way to be SQL injected is if you don't escape strings before inserting them into query. If you do that, you are good to go.

escape strings before inserting them into query what?

[Sergei]

Example.

pawn Код:

public OnPlayerLogin(playerid, password[])
{
    format(query,sizeof(query),"SELECT * FROM `players` WHERE name=SOMENAME AND password='%s'",
        password);
    //...
}

Now if someone inputs

Quote:

haha' OR 'this' = 'this

query would look like

Код:

SELECT * FROM `players` WHERE name=SOMENAME AND password='haha' OR 'this' = 'this'

which would be always true, so player could login without knowing the password.

So escaping string would return the next result

Код:

haha\' OR \'this\' = \'this

and query wouldn't be true anymore, so you couldn't login with any password.

You can read many articles about SQL injections around the internet and how to prevent them.

[ombre]

sql injection is possible with that? Or I need also to use mysql_real_escape_string for level adminlevel and SQL?

Код:

GetPlayerName( playerid, name, sizeof( name ) );
mysql_real_escape_string( name, name );
format( query, sizeof( query ), "UPDATE `accounts` SET \`Name`='%s',`Level`='%d',`AdminLevel`='%d' WHERE`SQL`='%d'",name, PlayerInfo[playerid][pLevel],PlayerInfo[playerid][pAdmin],PlayerInfo[playerid][pSQL]);
mysql_query();

[[HiC]TheKiller]

Quote:

Originally Posted by ombre sql injection is possible with that? Or I need also to use mysql_real_escape_string for level adminlevel and SQL? Код: GetPlayerName( playerid, name, sizeof( name ) ); mysql_real_escape_string( name, name ); format( query, sizeof( query ), "UPDATE `accounts` SET \`Name`='%s',`Level`='%d',`AdminLevel`='%d' WHERE`SQL`='%d'",name, PlayerInfo[playerid][pLevel],PlayerInfo[playerid][pAdmin],PlayerInfo[playerid][pSQL]); mysql_query();

For any player input, you should escape the queries. I also would recommend posting a new topic in scripting discussion rather then bumping a year old one.

[Jay_]

Benefits in oppose to what?