araxiaonline/TrinityCore
3
0
Fork 0
mirror of https://github.com/araxiaonline/TrinityCore.git synced 2026-06-15 20:52:22 -04:00
Code Issues Packages Projects Releases Wiki Activity

Core/DBLayer: Convert PQuery() queries to prepared statements

Browse Source
This commit is contained in:
leak
2012-03-24 01:25:08 +01:00
parent 8e96b86715
commit 12e55a04bb
37 changed files with 1037 additions and 457 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
src/server/game/Server/WorldSocket.cpp
View File

@@ -812,13 +812,11 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
clientSeed);
// Get the account information from the realmd database
std::string safe_account = account; // Duplicate, else will screw the SHA hash verification below
LoginDatabase.EscapeString (safe_account);
// No SQL injection, username escaped.
PreparedStatement* stmt = LoginDatabase.GetPreparedStatement(LOGIN_SEL_ACCOUNT_INFO_BY_NAME);
// 0 1 2 3 4 5 6 7 8 9 10
QueryResult result = LoginDatabase.PQuery ("SELECT id, sessionkey, last_ip, locked, v, s, expansion, mutetime, locale, recruiter, os FROM account "
"WHERE username = '%s'", safe_account.c_str());
stmt->setString(0, account);
PreparedQueryResult result = LoginDatabase.Query(stmt);
// Stop if the account is not found
if (!result)
@@ -899,29 +897,28 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
std::string os = fields[10].GetString();
// Checks gmlevel per Realm
result =
LoginDatabase.PQuery ("SELECT "
"RealmID, " //0
"gmlevel " //1
"FROM account_access "
"WHERE id = '%d'"
" AND (RealmID = '%d'"
" OR RealmID = '-1')",
id, realmID);
stmt = LoginDatabase.GetPreparedStatement(LOGIN_GET_GMLEVEL_BY_REALMID);
stmt->setUInt32(0, id);
stmt->setInt32(1, int32(realmID));
result = LoginDatabase.Query(stmt);
if (!result)
security = 0;
else
{
fields = result->Fetch();
security = fields[1].GetInt32();
security = fields[0].GetInt32();
}
// Re-check account ban (same check as in realmd)
QueryResult banresult =
LoginDatabase.PQuery ("SELECT 1 FROM account_banned WHERE id = %u AND active = 1 "
"UNION "
"SELECT 1 FROM ip_banned WHERE ip = '%s'",
id, GetRemoteAddress().c_str());
stmt = LoginDatabase.GetPreparedStatement(LOGIN_SEL_BANS);
stmt->setUInt32(0, id);
stmt->setString(1, GetRemoteAddress());
PreparedQueryResult banresult = LoginDatabase.Query(stmt);
if (banresult) // if account banned
{
@@ -976,7 +973,11 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
address.c_str());
// Check if this user is by any chance a recruiter
result = LoginDatabase.PQuery ("SELECT 1 FROM account WHERE recruiter = %u", id);
stmt = LoginDatabase.GetPreparedStatement(LOGIN_SEL_ACCOUNT_RECRUITER);
stmt->setUInt32(0, id);
result = LoginDatabase.Query(stmt);
bool isRecruiter = false;
if (result)
@@ -984,7 +985,7 @@ int WorldSocket::HandleAuthSession (WorldPacket& recvPacket)
// Update the last_ip in the database
PreparedStatement* stmt = LoginDatabase.GetPreparedStatement(LOGIN_UPD_LAST_IP);
stmt = LoginDatabase.GetPreparedStatement(LOGIN_UPD_LAST_IP);
stmt->setString(0, address);
stmt->setString(1, account);