Merge pull request #44 from Blizzard098/main

Escape SQL `groups` column value and LONGTEXT defaults.
This commit is contained in:
Andy
2023-12-14 00:54:12 +01:00
committed by GitHub
3 changed files with 9 additions and 9 deletions

View File

@@ -8,8 +8,8 @@ CREATE TABLE IF NOT EXISTS `nd_characters` (
`gender` VARCHAR(50) DEFAULT NULL, `gender` VARCHAR(50) DEFAULT NULL,
`cash` INT(10) DEFAULT '0', `cash` INT(10) DEFAULT '0',
`bank` INT(10) DEFAULT '0', `bank` INT(10) DEFAULT '0',
`groups` LONGTEXT DEFAULT '[]', `groups` LONGTEXT DEFAULT ('[]'),
`metadata` LONGTEXT DEFAULT '[]', `metadata` LONGTEXT DEFAULT ('[]'),
`inventory` LONGTEXT DEFAULT '[]', `inventory` LONGTEXT DEFAULT ('[]'),
PRIMARY KEY (`charid`) USING BTREE PRIMARY KEY (`charid`) USING BTREE
); );

View File

@@ -2,13 +2,13 @@ CREATE TABLE IF NOT EXISTS `nd_vehicles` (
`id` INT(11) NOT NULL AUTO_INCREMENT, `id` INT(11) NOT NULL AUTO_INCREMENT,
`owner` INT(11) DEFAULT NULL, `owner` INT(11) DEFAULT NULL,
`plate` VARCHAR(255) DEFAULT NULL, `plate` VARCHAR(255) DEFAULT NULL,
`glovebox` LONGTEXT DEFAULT '[]', `glovebox` LONGTEXT DEFAULT ('[]'),
`trunk` LONGTEXT DEFAULT '[]', `trunk` LONGTEXT DEFAULT ('[]'),
`properties` LONGTEXT DEFAULT '[]', `properties` LONGTEXT DEFAULT ('[]'),
`stored` INT(11) DEFAULT '1', `stored` INT(11) DEFAULT '1',
`impounded` INT(11) DEFAULT '0', `impounded` INT(11) DEFAULT '0',
`stolen` INT(11) DEFAULT '0', `stolen` INT(11) DEFAULT '0',
`metadata` LONGTEXT DEFAULT '[]', `metadata` LONGTEXT DEFAULT ('[]'),
PRIMARY KEY (`id`) USING BTREE, PRIMARY KEY (`id`) USING BTREE,
INDEX `owner` (`owner`) USING BTREE, INDEX `owner` (`owner`) USING BTREE,
CONSTRAINT `vehowner` FOREIGN KEY (`owner`) REFERENCES `nd_characters` (`charid`) ON UPDATE CASCADE ON DELETE CASCADE CONSTRAINT `vehowner` FOREIGN KEY (`owner`) REFERENCES `nd_characters` (`charid`) ON UPDATE CASCADE ON DELETE CASCADE

View File

@@ -165,7 +165,7 @@ local function createCharacterTable(info)
-- Save character information to database -- Save character information to database
function self.save() function self.save()
local affectedRows = MySQL.update.await("UPDATE nd_characters SET name = ?, firstname = ?, lastname = ?, dob = ?, gender = ?, cash = ?, bank = ?, groups = ?, metadata = ? WHERE charid = ?", { local affectedRows = MySQL.update.await("UPDATE nd_characters SET name = ?, firstname = ?, lastname = ?, dob = ?, gender = ?, cash = ?, bank = ?, `groups` = ?, metadata = ? WHERE charid = ?", {
self.name, self.name,
self.firstname, self.firstname,
self.lastname, self.lastname,
@@ -398,7 +398,7 @@ function NDCore.newCharacter(src, info)
inventory = info.inventory or {}, inventory = info.inventory or {},
} }
charInfo.id = MySQL.insert.await("INSERT INTO nd_characters (identifier, name, firstname, lastname, dob, gender, cash, bank, groups, metadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", { charInfo.id = MySQL.insert.await("INSERT INTO nd_characters (identifier, name, firstname, lastname, dob, gender, cash, bank, `groups`, metadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", {
identifier, identifier,
charInfo.name, charInfo.name,
charInfo.firstname, charInfo.firstname,