diff options
author | Haru <haru@dotalux.com> | 2017-11-18 20:23:46 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2017-11-18 20:23:46 +0100 |
commit | 66ee4dea37d47af769cc94c8b8ebd2b12699ce7c (patch) | |
tree | b524690b23670f041e8824d2eecec69f6dc80389 /src/login | |
parent | 901df02711777462bd9e4016c91b8166441d9353 (diff) | |
parent | e5a63561bba9d09e5a88636f4982cdb2cf57a569 (diff) | |
download | hercules-66ee4dea37d47af769cc94c8b8ebd2b12699ce7c.tar.gz hercules-66ee4dea37d47af769cc94c8b8ebd2b12699ce7c.tar.bz2 hercules-66ee4dea37d47af769cc94c8b8ebd2b12699ce7c.tar.xz hercules-66ee4dea37d47af769cc94c8b8ebd2b12699ce7c.zip |
Merge pull request #1901 from MishimaHaruna/sql-bind-types
Correct and sanitize SQL bind types
Diffstat (limited to 'src/login')
-rw-r--r-- | src/login/account_sql.c | 34 |
1 files changed, 17 insertions, 17 deletions
diff --git a/src/login/account_sql.c b/src/login/account_sql.c index 70d4f3dfb..66ede6cfa 100644 --- a/src/login/account_sql.c +++ b/src/login/account_sql.c @@ -599,16 +599,16 @@ static bool mmo_auth_tosql(AccountDB_SQL* db, const struct mmo_account* acc, boo if( SQL_SUCCESS != SQL->StmtPrepare(stmt, "INSERT INTO `%s` (`account_id`, `userid`, `user_pass`, `sex`, `email`, `group_id`, `state`, `unban_time`, `expiration_time`, `logincount`, `lastlogin`, `last_ip`, `birthdate`, `character_slots`, `pincode`, `pincode_change`) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", db->account_db) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_INT, &acc->account_id, sizeof(acc->account_id)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_INT, &acc->account_id, sizeof acc->account_id) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 1, SQLDT_STRING, acc->userid, strlen(acc->userid)) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 2, SQLDT_STRING, acc->pass, strlen(acc->pass)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 3, SQLDT_ENUM, &acc->sex, sizeof(acc->sex)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 3, SQLDT_ENUM, &acc->sex, sizeof acc->sex) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 4, SQLDT_STRING, &acc->email, strlen(acc->email)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 5, SQLDT_INT, &acc->group_id, sizeof(acc->group_id)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 6, SQLDT_UINT, &acc->state, sizeof(acc->state)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 7, SQLDT_LONG, &acc->unban_time, sizeof(acc->unban_time)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 8, SQLDT_INT, &acc->expiration_time, sizeof(acc->expiration_time)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 9, SQLDT_UINT, &acc->logincount, sizeof(acc->logincount)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 5, SQLDT_INT, &acc->group_id, sizeof acc->group_id) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 6, SQLDT_UINT, &acc->state, sizeof acc->state) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 7, SQLDT_TIME, &acc->unban_time, sizeof acc->unban_time) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 8, SQLDT_TIME, &acc->expiration_time, sizeof acc->expiration_time) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 9, SQLDT_UINT, &acc->logincount, sizeof acc->logincount) || SQL_SUCCESS != (acc->lastlogin[0] < '1' || acc->lastlogin[0] > '9' ? SQL->StmtBindParam(stmt, 10, SQLDT_NULL, NULL, 0) : SQL->StmtBindParam(stmt, 10, SQLDT_STRING, &acc->lastlogin, strlen(acc->lastlogin)) @@ -618,9 +618,9 @@ static bool mmo_auth_tosql(AccountDB_SQL* db, const struct mmo_account* acc, boo SQL->StmtBindParam(stmt, 12, SQLDT_NULL, NULL, 0) : SQL->StmtBindParam(stmt, 12, SQLDT_STRING, &acc->birthdate, strlen(acc->birthdate)) ) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 13, SQLDT_UCHAR, &acc->char_slots, sizeof(acc->char_slots)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 13, SQLDT_UINT8, &acc->char_slots, sizeof acc->char_slots) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 14, SQLDT_STRING, &acc->pincode, strlen(acc->pincode)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 15, SQLDT_LONG, &acc->pincode_change, sizeof(acc->pincode_change)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 15, SQLDT_UINT, &acc->pincode_change, sizeof acc->pincode_change) || SQL_SUCCESS != SQL->StmtExecute(stmt) ) { SqlStmt_ShowDebug(stmt); @@ -630,13 +630,13 @@ static bool mmo_auth_tosql(AccountDB_SQL* db, const struct mmo_account* acc, boo if( SQL_SUCCESS != SQL->StmtPrepare(stmt, "UPDATE `%s` SET `userid`=?,`user_pass`=?,`sex`=?,`email`=?,`group_id`=?,`state`=?,`unban_time`=?,`expiration_time`=?,`logincount`=?,`lastlogin`=?,`last_ip`=?,`birthdate`=?,`character_slots`=?,`pincode`=?,`pincode_change`=? WHERE `account_id` = '%d'", db->account_db, acc->account_id) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 0, SQLDT_STRING, acc->userid, strlen(acc->userid)) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 1, SQLDT_STRING, acc->pass, strlen(acc->pass)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 2, SQLDT_ENUM, &acc->sex, sizeof(acc->sex)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 2, SQLDT_ENUM, &acc->sex, sizeof acc->sex) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 3, SQLDT_STRING, acc->email, strlen(acc->email)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 4, SQLDT_INT, &acc->group_id, sizeof(acc->group_id)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 5, SQLDT_UINT, &acc->state, sizeof(acc->state)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 6, SQLDT_LONG, &acc->unban_time, sizeof(acc->unban_time)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 7, SQLDT_LONG, &acc->expiration_time, sizeof(acc->expiration_time)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 8, SQLDT_UINT, &acc->logincount, sizeof(acc->logincount)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 4, SQLDT_INT, &acc->group_id, sizeof acc->group_id) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 5, SQLDT_UINT, &acc->state, sizeof acc->state) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 6, SQLDT_TIME, &acc->unban_time, sizeof acc->unban_time) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 7, SQLDT_TIME, &acc->expiration_time, sizeof acc->expiration_time) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 8, SQLDT_UINT, &acc->logincount, sizeof acc->logincount) || SQL_SUCCESS != (acc->lastlogin[0] < '1' || acc->lastlogin[0] > '9' ? SQL->StmtBindParam(stmt, 9, SQLDT_NULL, NULL, 0) : SQL->StmtBindParam(stmt, 9, SQLDT_STRING, &acc->lastlogin, strlen(acc->lastlogin)) @@ -646,9 +646,9 @@ static bool mmo_auth_tosql(AccountDB_SQL* db, const struct mmo_account* acc, boo SQL->StmtBindParam(stmt, 11, SQLDT_NULL, NULL, 0) : SQL->StmtBindParam(stmt, 11, SQLDT_STRING, &acc->birthdate, strlen(acc->birthdate)) ) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 12, SQLDT_UCHAR, &acc->char_slots, sizeof(acc->char_slots)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 12, SQLDT_UINT8, &acc->char_slots, sizeof acc->char_slots) || SQL_SUCCESS != SQL->StmtBindParam(stmt, 13, SQLDT_STRING, &acc->pincode, strlen(acc->pincode)) - || SQL_SUCCESS != SQL->StmtBindParam(stmt, 14, SQLDT_LONG, &acc->pincode_change, sizeof(acc->pincode_change)) + || SQL_SUCCESS != SQL->StmtBindParam(stmt, 14, SQLDT_UINT, &acc->pincode_change, sizeof acc->pincode_change) || SQL_SUCCESS != SQL->StmtExecute(stmt) ) { SqlStmt_ShowDebug(stmt); |