From 8b7642932dffeb7e6d8a90d656791b4ff3ba15f7 Mon Sep 17 00:00:00 2001 From: Erik Schilling Date: Mon, 3 Feb 2014 22:02:35 +0100 Subject: Fixed SQL Injection --- src/account-server/storage.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src/account-server/storage.cpp') diff --git a/src/account-server/storage.cpp b/src/account-server/storage.cpp index 25e75182..656dfad9 100644 --- a/src/account-server/storage.cpp +++ b/src/account-server/storage.cpp @@ -988,8 +988,7 @@ void Storage::flush(Account *account) << " (user_id, name, gender, hair_style, hair_color," << " char_pts, correct_pts," << " x, y, map_id, slot) values (" - << account->getID() << ", \"" - << character->getName() << "\", " + << account->getID() << ", ?, " << character->getGender() << ", " << (int)character->getHairStyle() << ", " << (int)character->getHairColor() << ", " @@ -1001,7 +1000,9 @@ void Storage::flush(Account *account) << character->getCharacterSlot() << ");"; - mDb->execSql(sqlInsertCharactersTable.str()); + mDb->prepareSql(sqlInsertCharactersTable.str()); + mDb->bindValue(1, character->getName()); + mDb->processSql(); // Update the character ID. character->setDatabaseID(mDb->getLastId()); -- cgit v1.2.3-60-g2f50