From ffed5a9e22284a4aea034171c026ba564b98793c Mon Sep 17 00:00:00 2001 From: KimLS Date: Sat, 6 Sep 2014 16:43:36 -0700 Subject: [PATCH] SQL Injection fix on inspect message setting --- common/shareddb.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/common/shareddb.cpp b/common/shareddb.cpp index 4485851c1..10e3d2012 100644 --- a/common/shareddb.cpp +++ b/common/shareddb.cpp @@ -2148,7 +2148,8 @@ void SharedDatabase::SetPlayerInspectMessage(char* playername, const InspectMess char errbuf[MYSQL_ERRMSG_SIZE]; char *query = 0; - if (!RunQuery(query, MakeAnyLenString(&query, "UPDATE character_ SET inspectmessage='%s' WHERE name='%s'", message->text, playername), errbuf)) { + std::string msg = EscapeString(message->text); + if (!RunQuery(query, MakeAnyLenString(&query, "UPDATE character_ SET inspectmessage='%s' WHERE name='%s'", msg.c_str(), playername), errbuf)) { std::cerr << "Error in SetPlayerInspectMessage query '" << query << "' " << errbuf << std::endl; } @@ -2183,7 +2184,8 @@ void SharedDatabase::SetBotInspectMessage(uint32 botid, const InspectMessage_Str char errbuf[MYSQL_ERRMSG_SIZE]; char *query = 0; - if (!RunQuery(query, MakeAnyLenString(&query, "UPDATE bots SET BotInspectMessage='%s' WHERE BotID=%i", message->text, botid), errbuf)) { + std::string msg = EscapeString(message->text); + if (!RunQuery(query, MakeAnyLenString(&query, "UPDATE bots SET BotInspectMessage='%s' WHERE BotID=%i", msg.c_str(), botid), errbuf)) { std::cerr << "Error in SetBotInspectMessage query '" << query << "' " << errbuf << std::endl; }