Page 1 of 1
sql error
Posted: 2011 Jul 22 13:25
by aurimasko
Code: Select all
public connect_message(id){ new name[50], steamid[32], ip[32] get_user_info(id, "name", name, 49) get_user_authid(id, steamid, 31) get_user_ip(id, ip, 31, 1) new ErrorCode,Handle:SqlConnection = SQL_Connect(g_SqlTuple,ErrorCode,g_Error,511) if(g_SqlTuple == Empty_Handle) { log_amx(g_Error) } new Handle:Query = SQL_PrepareQuery(SqlConnection,"SELECT * FROM `vvp_users` WHERE (`username`='%s' OR `ip`='%s' OR `steamid`='%s')", name, ip, steamid)}
Erroras:
Code: Select all
L 07/22/2011 - 14:20:22: [public_vip.amxx] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 't Stop | auD maS' OR `ip`='78.63.100.209' OR `steamid`='STEAM_0:0:947429302')' at line 1
O nickas ne
t Stop.., o
Don't Stop | auD maS
Kaip galima būtų ištaisyt?
Re: sql error
Posted: 2011 Jul 22 13:31
by morka
mysql_escape_string(); arba su Regular Expresions patikrint ir neleisti ivesti tokiu simboliu kaip apostrofos, arba dar galima is ivedamo teksto istrinti tokius simbolius.
Nes taip gausis kaip sql injeksija.
Re: sql error
Posted: 2011 Jul 22 13:45
by psychical
Naudok "(bent php tai imanoma) vietoj ' Query'je, del amxx mysql nzn
Re: sql error
Posted: 2011 Jul 22 13:54
by aaarnas
Pamėgink niką prieš tau praleisti pro šitą funkciją:
SQL_QuoteString
Nepamiršk, kad reikia šiai funkcijai ne tuple handle, o connection.
Be to nesvarbu kokia programavimo kalba, visur sql užklausos turi savo taisykles ir visos kalbos vienodai suformatuoja, skiriasi tik kaip jos tai padaro.
Re: sql error
Posted: 2011 Jul 22 16:16
by aurimasko
o tai mano sql būdas blogas?
Re: sql error
Posted: 2011 Jul 22 16:44
by aaarnas
Code: Select all
public connect_message(id){ new name[50], steamid[32], ip[32] get_user_info(id, "name", name, 49) get_user_authid(id, steamid, 31) get_user_ip(id, ip, 31, 1) new ErrorCode,Handle:SqlConnection = SQL_Connect(g_SqlTuple,ErrorCode,g_Error,511) if(g_SqlTuple == Empty_Handle) { log_amx(g_Error) } SQL_QuoteString(SqlConnection, name, charsmax(name), name) new Handle:Query = SQL_PrepareQuery(SqlConnection,"SELECT * FROM `vvp_users` WHERE (`username`='%s' OR `ip`='%s' OR `steamid`='%s')", name, ip, steamid)}
Re: sql error
Posted: 2011 Jul 30 12:38
by morka
Pazejau tai pats zaidimas pasalina ' " simbolius, tipo vistiek is amxx puses reikia konvertuoti? Galima su exploitais prisijungt prie serverio su siais zenklais?
Re: sql error
Posted: 2011 Jul 30 13:37
by aaarnas
Reikia žiūrėti kokia yra sql klaida ir ją taisyti.