Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement an auto-escaping Format native for SQL query construction #476

Merged
merged 7 commits into from Oct 3, 2016

Conversation

asherkin
Copy link
Member

Probably best to look at this one commit-by-commit.

Will need some doc work on the wiki after landing.
The gist of it is that if formatting via the new native, "%s", "%N", "%L" etc are automatically escaped unless a new "!" flag is set (i.e. "%!s"), and an error is thrown if the string is going to be truncated (to avoid leaving a trailing escape character).

Old:

char name[MAX_NAME_LENGTH];
if (!GetClientName(client, name, sizeof(name))) {
  return false;
}

int safeNameLen = (strlen(name) * 2) + 1;
char[] safeName = new char[safeNameLen];
db.Escape(name, safeName, safeNameLen);

char steamId[32];
if (!GetClientAuthId(client, AuthId_Steam2, steamId, sizeof(steamId))) {
  return false;
}

int safeSteamIdLen = (strlen(steamId) * 2) + 1;
char[] safeSteamId = new char[safeSteamIdLen];
db.Escape(steamId, safeSteamId, safeSteamIdLen);

char buffer[512];
Format(buffer, sizeof(buffer), "UPDATE players SET name = '%s' WHERE steamid = '%s'", safeName, safeSteamId);
db.Query(OnQueryComplete, buffer);

New:

char steamId[32];
if (!GetClientAuthId(client, AuthId_Steam2, steamid, sizeof(steamid))) {
  return false;
}

char buffer[512];
db.Format(buffer, sizeof(buffer), "UPDATE players SET name = '%N' WHERE steamid = '%s'", client, steamId);
db.Query(OnQueryComplete, buffer);

@psychonic
Copy link
Member

Looks okay to me.

I'd also be fine with ditching the non-methodmap version of the function to encourage use of the newer syntax.

@asherkin asherkin merged commit 47dd287 into master Oct 3, 2016
@asherkin asherkin deleted the query-format branch October 3, 2016 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants