ChronosXYZ/sfcnr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix potential sql injection vulernability :O

Browse Source
This commit is contained in:
Lorenc Pekaj 2018-09-25 23:46:30 +10:00
parent df5038457e
commit c535ca1796
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
gamemodes/irresistible/cnr/features/houses/house.pwn
View File

@ -320,7 +320,7 @@ hook OnDialogResponse( playerid, dialogid, response, listitem, inputtext[ ] )
new houseid = p_InHouse[ playerid ];
format( g_houseData[ houseid ] [ E_HOUSE_NAME ], 30, "%s", inputtext);
mysql_format( dbHandle, szNormalString, sizeof( szNormalString ), "UPDATE `HOUSES` SET `NAME`='%s' WHERE `ID`=%d", g_houseData[ houseid ] [ E_HOUSE_NAME ], p_InHouse[ playerid ] );
mysql_format( dbHandle, szNormalString, sizeof( szNormalString ), "UPDATE `HOUSES` SET `NAME`='%e' WHERE `ID`=%d", g_houseData[ houseid ] [ E_HOUSE_NAME ], p_InHouse[ playerid ] );
mysql_single_query( szNormalString );
format( szBigString, sizeof( szBigString ), ""COL_GOLD"House:"COL_WHITE" %s(%d)\n"COL_GOLD"Owner:"COL_WHITE" %s\n"COL_GOLD"Price:"COL_WHITE" %s", g_houseData[ houseid ] [ E_HOUSE_NAME ], houseid, g_houseData[ houseid ] [ E_OWNER ], cash_format( g_houseData[ houseid ] [ E_COST ] ) );
UpdateDynamic3DTextLabelText( g_houseData[ houseid ] [ E_LABEL ] [ 0 ], COLOR_WHITE, szBigString );