SQLi Injection

[HiddenMotives]

Please take a look at using Prepared Statements the ServerAuthWebAPI.php is just waiting to be exploited. Way too many SQL Injections exist.

For example:

<?php
//Include ServerAuth Web API
include 'ServerAuthWebAPI.php';
//Player to check
$player = "1' or '1' = '1";
//Initialize a ServerAuthWebAPI instance (put your ServerAuth MySQL data)
$api = new ServerAuthWebAPI("host", 3306, "username", "password", "serverauth", "srvauth_");
var_dump($api->isPlayerRegistered($player));
?>

Where $player = "1' or '1' = '1";
to demonstrate this issue. The result would be true.

[PEMapModder]

Personally I think that using escape_string() is easier :)

[HiddenMotives]

Easy but not as effective and if its not as effective that defeats the purpose.

[PEMapModder]

But at least it covers the vulnerability :)

[HiddenMotives]

No it would not be sufficient for a web application it at this level. You need to use prepared statements.

[PEMapModder]

why?

[Flavius12]

Fixed in v2.12