Database

[Cena]

My db is'nt saving i tryed many things

Code Select Expand

QuerySQL( sqliteDB, "UPDATE Accounts SET Cash='" + Cash + "', Bank='" + Bank + "', Kills='" + Kills + "', Deaths='" + Deaths + "', Level='" + Level + "', LastUsedIP='" + LastUsedIP + "' WHERE Name='" + player.Name + "' AND NameLower='" + player.Name.tolower() + "'" );

also tryed this in a function and in onPlayerPart but still not working . I tryed to execute this in db it is working there but in script it not working.... plz help

[.]

Christ man. Who dafuq uses that many concatenations. Why cant you use functions like format() to make the query. Easier to spot the syntax errors.

Besides, the official plugin does not report query errors. Which means you must manually execute the query in a program that can locate the error or use an alternate SQLite plugin.

Either way. No one has the patience and time to look through all that crap to find your missing quote or comma. You dig this hole your self. Now you get out of it.

Integers in quotes? Who does that. (thankfully sqlite does implicit conversions).

Code Select Expand

QuerySQL(sqliteDB,
    format(@"UPDATE [Accounts] SET
        [Cash]=%i,
        [Bank]=%i,
        [Kills]=%i,
        [Deaths]=%i,
        [Level]=%i,
        [LastUsedIP]='%s'
        WHERE [Name]='%s' AND [NameLower]='%s';",
        Cash,
        Bank,
        Kills,
        Deaths,
        Level,
        LastUsedIP,
        player.Name,
        player.Name.tolower()
    )
);

[ysc3839]

Christ man. Who dafuq uses that many concatenations. Why cant you use functions like format() to make the query. Easier to spot the syntax errors.

Besides, the official plugin does not report query errors. Which means you must manually execute the query in a program that can locate the error or use an alternate SQLite plugin.

Either way. No one has the patience and time to look through all that crap to find your missing quote or comma. You dig this hole your self. Now you get out of it.

Integers in quotes? Who does that. (thankfully sqlite does implicit conversions).

Code Select Expand

QuerySQL(sqliteDB,
    format(@"UPDATE [Accounts] SET
        [Cash]=%i,
        [Bank]=%i,
        [Kills]=%i,
        [Deaths]=%i,
        [Level]=%i,
        [LastUsedIP]='%s'
        WHERE [Name]='%s' AND [NameLower]='%s';",
        Cash,
        Bank,
        Kills,
        Deaths,
        Level,
        LastUsedIP,
        player.Name,
        player.Name.tolower()
    )
);

I suggest use SQL bind, which can prevent SQL injection.

[.]

I suggest use SQL bind, which can prevent SQL injection.

That's what I use but unfortunately neither SQLite plugins have that functionality

[vito]

Good point about injections in vc-mp... currently only way I know is remove any quotes symbols and backslashes.

[KAKAN]

Good point about injections in vc-mp... currently only way I know is remove any quotes symbols and backslashes.

escapeSQLString. Though, I believe you don't need this for an average VCMP player. They will just play, they don't have a intention to hax

[ysc3839]

Good point about injections in vc-mp... currently only way I know is remove any quotes symbols and backslashes.

escapeSQLString. Though, I believe you don't need this for an average VCMP player. They will just play, they don't have a intention to hax

escapeSQLString is OK. But SQL bind is more convenient.

[KAKAN]

Good point about injections in vc-mp... currently only way I know is remove any quotes symbols and backslashes.

escapeSQLString. Though, I believe you don't need this for an average VCMP player. They will just play, they don't have a intention to hax

escapeSQLString is OK. But SQL bind is more convenient.

I don't even think that SQL Bind is needed for VCMP( unless SLC plays )

[ysc3839]

Good point about injections in vc-mp... currently only way I know is remove any quotes symbols and backslashes.

escapeSQLString. Though, I believe you don't need this for an average VCMP player. They will just play, they don't have a intention to hax

escapeSQLString is OK. But SQL bind is more convenient.

I don't even think that SQL Bind is needed for VCMP( unless SLC plays )

I disagree.

[EK.IceFlake]

Well...
I was playing on my server and it was a fresh install so I had to make me admin... I didn't want SQLite browser so I tried injecting the code... didn't work
I typed: /saveloc '; update players set level=24 where lower(name)='ext-d.crysta;blue';--
no luck
I didn't have any SQLite injection protection

[ysc3839]

Well...
I was playing on my server and it was a fresh install so I had to make me admin... I didn't want SQLite browser so I tried injecting the code... didn't work
I typed: /saveloc '; update players set level=24 where lower(name)='ext-d.crysta;blue';--
no luck
I didn't have any SQLite injection protection

Show your /saveloc code.

[Thijn]

And show your database structure.