ExecuteSQLQuery - Revision history

Zangomangu: Undo revision 66548 by Abdo Nour (talk)

2020-05-15T21:33:30Z

Undo revision 66548 by Abdo Nour (talk)

← Older revision		Revision as of 21:33, 15 May 2020
Line 32:		Line 32:
	Below are examples of equivalents for the deprecated executeSQL functions. Note that ` (backtick) can optionally be used to surround table and row names. It usually a good idea to do this to avoid name clashes with SQL reserved words.		Below are examples of equivalents for the deprecated executeSQL functions. Note that ` (backtick) can optionally be used to surround table and row names. It usually a good idea to do this to avoid name clashes with SQL reserved words.

	~~مثال لعمل جدول جديد~~:		Example equivalents for executeSQLCreateTable:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	executeSQLQuery("CREATE TABLE IF NOT EXISTS players (clothes_head_texture TEXT, clothes_head_model TEXT, name TEXT)") ~~-- اذا لا يوجد جدول بنفس الإسم يصنع جدول بإسم players ويضع كولمن بداخل الجدول~~		executeSQLQuery("CREATE TABLE IF NOT EXISTS players (clothes_head_texture TEXT, clothes_head_model TEXT, name TEXT)")
	executeSQLQuery("CREATE TABLE IF NOT EXISTS `players` (`clothes_head_texture` TEXT, `clothes_head_model` TEXT, `name` TEXT)") ~~-- اذا لا يوجد جدول بنفس الإسم يصنع جدول بإسم `players` ويضع كولمن بداخل الجدول~~		executeSQLQuery("CREATE TABLE IF NOT EXISTS `players` (`clothes_head_texture` TEXT, `clothes_head_model` TEXT, `name` TEXT)")
	</syntaxhighlight>		</syntaxhighlight>

	~~مثال لحذف رو من الجدول~~:		Example equivalents for executeSQLDelete:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer) ~~-- إحضار اسم اللاعب~~		playerName = getPlayerName(thePlayer)
	executeSQLQuery("DELETE FROM players WHERE name=?", playerName) ~~-- حذف الرو الخاص باللاعب المعرف بالكولمن name من خلال اسمه~~		executeSQLQuery("DELETE FROM players WHERE name=?", playerName)
	executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName) ~~-- حذف الرو الخاص اللاعب المعرف بالكولمن `name` من خلال اسمه~~		executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName)
	</syntaxhighlight>		</syntaxhighlight>

	~~مثال لحذف الجدول بالكامل~~:		Example equivalents for executeSQLDropTable:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	executeSQLQuery("DROP TABLE players" ) ~~-- حذف الجدول المسمي بـ players~~		executeSQLQuery("DROP TABLE players" )
	executeSQLQuery("DROP TABLE `players`" ) ~~-- حذف الجدول المسمي بـ `players`~~		executeSQLQuery("DROP TABLE `players`" )
	</syntaxhighlight>		</syntaxhighlight>

	Example equivalents for executeSQLSelect:		Example equivalents for executeSQLSelect:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer) ~~-- إحضار اسم اللاعب~~		playerName = getPlayerName(thePlayer)
	executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName ) ~~-- الحصول علي المعلومات المخزنة التي تحتوي علي نقاط ودم اللاعب من خلال اسمه المعرف بجدول players وبكولمن name~~		executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName )
	executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName ) ~~-- الحصول علي المعلومات المخزنة التي تحتوي علي نقاط ودم اللاعب من خلال اسمه المعرف بجدول `players` وبكولمن `name`~~		executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName )
	</syntaxhighlight>		</syntaxhighlight>

	~~مثال لوضع رو جديد بالكولمن~~:		Example equivalents for executeSQLInsert:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer) ~~-- احضار اسم اللاعب~~		playerName = getPlayerName(thePlayer)
	colorName = "Blue" ~~-- لون الإسم~~		colorName = "Blue"
	soundName = "sound.mp3" ~~-- الصوت الخاص بالإسم~~		soundName = "sound.mp3"
	executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName ) ~~-- اختيار الجدول players ووضع رو الاسم بكولمن name ووضع رو اللون بكولمن color ووضع رو الصوت بكولمن sound.~~		executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName )
	executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName ) ~~-- اختيار الجدول `players` ووضع رو الاسم بكولمن `name` ووضع رو اللون بكولمن `color` ووضع رو الصوت بكولمن `sound`.~~		executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName )
	</syntaxhighlight>		</syntaxhighlight>

	~~مثال لتحديث معلومات رو معين بالكولمن~~:		Example equivalents for executeSQLUpdate:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer) ~~-- اسم اللاعب~~		playerName = getPlayerName(thePlayer)
	colorName = "Blue" ~~-- لون الاسم~~		colorName = "Blue"
	soundName = "sound.mp3" ~~-- الصوت الخاص بالاسم~~		soundName = "sound.mp3"
	executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName ) ~~-- تحديث الرو الخاص بإسم اللاعب وتعريف المعلومات عن طريق كتابة التعريف بجانب كل كولمن ليتم حفظه في رو اللاعب~~		executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName )
	executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName ) ~~-- تحديث الرو الخاص بإسم اللاعب وتعريف المعلومات عن طريق المعلومات التي جلبناها من قبل فوق~~		executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName )
	executeSQLQuery("UPDATE `players` SET `color`=?,`sound`=? WHERE `name`=?", colorName, soundName, playerName ) ~~-- تحديث الرو الخاص بإسم اللاعب ولكن بجدول وكولمن مختلف~~		executeSQLQuery("UPDATE `players` SET `color`=?,`sound`=? WHERE `name`=?", colorName, soundName, playerName )
	</syntaxhighlight>		</syntaxhighlight>


	~~هذا المثال يعرض قائمة اللاعبين المسجلين في قاعدة البيانات والذين لدليهم اكثر عدد من المال~~.		This example defines a console command that shows the ID's and names of all registered (stored in database) players that have more than the specified amount of money.

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	function listPlayersWithMoreMoneyThan(thePlayer, command, amount) ~~-- عمل وظيفة~~		function listPlayersWithMoreMoneyThan(thePlayer, command, amount)
	local players = executeSQLQuery("SELECT id, name FROM players WHERE money > ?", tonumber(amount)) ~~-- اختيار اسم اللاعب من خلال اكثر عدد من المال المسجل في القاعدة وتعريفها بإسم players ليتم جلبها فيما بعد~~		local players = executeSQLQuery("SELECT id, name FROM players WHERE money > ?", tonumber(amount))
	outputConsole("Players with more money than " .. amount .. ":", thePlayer)		outputConsole("Players with more money than " .. amount .. ":", thePlayer)
	for i, playerdata in ipairs(players) do ~~-- اختيار معلومات اللاعب من القاعدة المعرفة بإسم players~~		for i, playerdata in ipairs(players) do
	outputConsole(playerdata.id .. ": " .. playerdata.name, thePlayer) ~~-- اظهار رقم الرو و اسم اللاعب في اف8~~		outputConsole(playerdata.id .. ": " .. playerdata.name, thePlayer)
	end		end
	end		end

	addCommandHandler("richplayers", listPlayersWithMoreMoneyThan) ~~-- كتابة الامر rechplayers لتشغيل الوظيفة~~		addCommandHandler("richplayers", listPlayersWithMoreMoneyThan)
	</syntaxhighlight>		</syntaxhighlight>

Line 96:		Line 96:

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	function showPlayerMoney(thePlayer, command, playerName) ~~-- عمل وظيفة~~		function showPlayerMoney(thePlayer, command, playerName)
	local result = executeSQLQuery("SELECT money FROM players WHERE name=?", playerName) ~~-- جلب عدد المال من قاعدة players من خلال الاسم~~		local result = executeSQLQuery("SELECT money FROM players WHERE name=?", playerName)
	if(#result == 0) then ~~-- نتأكد اذا الجدول = 0~~		if(#result == 0) then
	outputConsole("No player named " .. playerName .. " is registered.", thePlayer) ~~-- يرسل ب اف8 للاعب ان اسم اللاعب ليس مسجل~~		outputConsole("No player named " .. playerName .. " is registered.", thePlayer)
	else ~~-- اذا الجدول لا يساوي 0~~		else
	outputConsole("Money amount of player " .. playerName .. " is " .. result[1].money, thePlayer) ~~-- يكتب اسم اللاعب وعدد المال المسجل في القاعده لديه~~		outputConsole("Money amount of player " .. playerName .. " is " .. result[1].money, thePlayer)
	end ~~-- انهاء التحقق~~		end
	end ~~-- انهاء الوظيفة~~		end
	addCommandHandler("playermoney", showPlayerMoney) ~~-- كتابة الامر playermoney لتشغيل الوظيفة~~		addCommandHandler("playermoney", showPlayerMoney)
	</syntaxhighlight>		</syntaxhighlight>

Line 110:		Line 110:

	The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.		The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.

	~~By: [Abdo Nour]~~

	==See Also==		==See Also==

Zangomangu: Undo revision 66549 by Abdo Nour (talk)

2020-05-15T21:33:18Z

Undo revision 66549 by Abdo Nour (talk)

← Older revision		Revision as of 21:33, 15 May 2020
Line 11:		Line 11:

	===Required Arguments===		===Required Arguments===
	*'''query:''' ~~استعلامات~~ SQL. ~~يتم وضع علامة~~ "?" ~~علي المواضع التي سوف يتم ادراج قيم المعلومات فيها~~.		*'''query:''' An SQL query. Positions where parameter values will be inserted are marked with a "?".

	===Optional Arguments===		===Optional Arguments===

Abdo Nour: /* Required Arguments */

2020-05-15T16:28:59Z

Required Arguments

← Older revision		Revision as of 16:28, 15 May 2020
Line 11:		Line 11:

	===Required Arguments===		===Required Arguments===
	*'''query:''' An SQL ~~query~~. ~~Positions where parameter values will be inserted are marked with a~~ "?".		*'''query:''' استعلامات SQL. يتم وضع علامة "?" علي المواضع التي سوف يتم ادراج قيم المعلومات فيها.

	===Optional Arguments===		===Optional Arguments===

Abdo Nour: /* هذه القاعدة تستخدم لحفظ البيانات وجلبها ولا يتم حذف البيانات في حالة الخروج او اغلاق السيرفر */

2020-05-15T16:26:04Z

هذه القاعدة تستخدم لحفظ البيانات وجلبها ولا يتم حذف البيانات في حالة الخروج او اغلاق السيرفر

← Older revision		Revision as of 16:26, 15 May 2020
Line 32:		Line 32:
	Below are examples of equivalents for the deprecated executeSQL functions. Note that ` (backtick) can optionally be used to surround table and row names. It usually a good idea to do this to avoid name clashes with SQL reserved words.		Below are examples of equivalents for the deprecated executeSQL functions. Note that ` (backtick) can optionally be used to surround table and row names. It usually a good idea to do this to avoid name clashes with SQL reserved words.

	~~Example equivalents for executeSQLCreateTable~~:		مثال لعمل جدول جديد:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	executeSQLQuery("CREATE TABLE IF NOT EXISTS players (clothes_head_texture TEXT, clothes_head_model TEXT, name TEXT)")		executeSQLQuery("CREATE TABLE IF NOT EXISTS players (clothes_head_texture TEXT, clothes_head_model TEXT, name TEXT)") -- اذا لا يوجد جدول بنفس الإسم يصنع جدول بإسم players ويضع كولمن بداخل الجدول
	executeSQLQuery("CREATE TABLE IF NOT EXISTS `players` (`clothes_head_texture` TEXT, `clothes_head_model` TEXT, `name` TEXT)")		executeSQLQuery("CREATE TABLE IF NOT EXISTS `players` (`clothes_head_texture` TEXT, `clothes_head_model` TEXT, `name` TEXT)") -- اذا لا يوجد جدول بنفس الإسم يصنع جدول بإسم `players` ويضع كولمن بداخل الجدول
	</syntaxhighlight>		</syntaxhighlight>

	~~Example equivalents for executeSQLDelete~~:		مثال لحذف رو من الجدول:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer)		playerName = getPlayerName(thePlayer) -- إحضار اسم اللاعب
	executeSQLQuery("DELETE FROM players WHERE name=?", playerName)		executeSQLQuery("DELETE FROM players WHERE name=?", playerName) -- حذف الرو الخاص باللاعب المعرف بالكولمن name من خلال اسمه
	executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName)		executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName) -- حذف الرو الخاص اللاعب المعرف بالكولمن `name` من خلال اسمه
	</syntaxhighlight>		</syntaxhighlight>

	~~Example equivalents for executeSQLDropTable~~:		مثال لحذف الجدول بالكامل:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	executeSQLQuery("DROP TABLE players" )		executeSQLQuery("DROP TABLE players" ) -- حذف الجدول المسمي بـ players
	executeSQLQuery("DROP TABLE `players`" )		executeSQLQuery("DROP TABLE `players`" ) -- حذف الجدول المسمي بـ `players`
	</syntaxhighlight>		</syntaxhighlight>

	Example equivalents for executeSQLSelect:		Example equivalents for executeSQLSelect:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer)		playerName = getPlayerName(thePlayer) -- إحضار اسم اللاعب
	executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName )		executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName ) -- الحصول علي المعلومات المخزنة التي تحتوي علي نقاط ودم اللاعب من خلال اسمه المعرف بجدول players وبكولمن name
	executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName )		executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName ) -- الحصول علي المعلومات المخزنة التي تحتوي علي نقاط ودم اللاعب من خلال اسمه المعرف بجدول `players` وبكولمن `name`
	</syntaxhighlight>		</syntaxhighlight>

	~~Example equivalents for executeSQLInsert~~:		مثال لوضع رو جديد بالكولمن:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer)		playerName = getPlayerName(thePlayer) -- احضار اسم اللاعب
	colorName = "Blue"		colorName = "Blue" -- لون الإسم
	soundName = "sound.mp3"		soundName = "sound.mp3" -- الصوت الخاص بالإسم
	executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName )		executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName ) -- اختيار الجدول players ووضع رو الاسم بكولمن name ووضع رو اللون بكولمن color ووضع رو الصوت بكولمن sound.
	executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName )		executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName ) -- اختيار الجدول `players` ووضع رو الاسم بكولمن `name` ووضع رو اللون بكولمن `color` ووضع رو الصوت بكولمن `sound`.
	</syntaxhighlight>		</syntaxhighlight>

	~~Example equivalents for executeSQLUpdate~~:		مثال لتحديث معلومات رو معين بالكولمن:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	playerName = getPlayerName(thePlayer)		playerName = getPlayerName(thePlayer) -- اسم اللاعب
	colorName = "Blue"		colorName = "Blue" -- لون الاسم
	soundName = "sound.mp3"		soundName = "sound.mp3" -- الصوت الخاص بالاسم
	executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName )		executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName ) -- تحديث الرو الخاص بإسم اللاعب وتعريف المعلومات عن طريق كتابة التعريف بجانب كل كولمن ليتم حفظه في رو اللاعب
	executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName )		executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName ) -- تحديث الرو الخاص بإسم اللاعب وتعريف المعلومات عن طريق المعلومات التي جلبناها من قبل فوق
	executeSQLQuery("UPDATE `players` SET `color`=?,`sound`=? WHERE `name`=?", colorName, soundName, playerName )		executeSQLQuery("UPDATE `players` SET `color`=?,`sound`=? WHERE `name`=?", colorName, soundName, playerName ) -- تحديث الرو الخاص بإسم اللاعب ولكن بجدول وكولمن مختلف
	</syntaxhighlight>		</syntaxhighlight>


	~~This example defines a console command that shows the ID's and names of all registered (stored in database) players that have more than the specified amount of money~~.		هذا المثال يعرض قائمة اللاعبين المسجلين في قاعدة البيانات والذين لدليهم اكثر عدد من المال.

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	function listPlayersWithMoreMoneyThan(thePlayer, command, amount)		function listPlayersWithMoreMoneyThan(thePlayer, command, amount) -- عمل وظيفة
	local players = executeSQLQuery("SELECT id, name FROM players WHERE money > ?", tonumber(amount))		local players = executeSQLQuery("SELECT id, name FROM players WHERE money > ?", tonumber(amount)) -- اختيار اسم اللاعب من خلال اكثر عدد من المال المسجل في القاعدة وتعريفها بإسم players ليتم جلبها فيما بعد
	outputConsole("Players with more money than " .. amount .. ":", thePlayer)		outputConsole("Players with more money than " .. amount .. ":", thePlayer)
	for i, playerdata in ipairs(players) do		for i, playerdata in ipairs(players) do -- اختيار معلومات اللاعب من القاعدة المعرفة بإسم players
	outputConsole(playerdata.id .. ": " .. playerdata.name, thePlayer)		outputConsole(playerdata.id .. ": " .. playerdata.name, thePlayer) -- اظهار رقم الرو و اسم اللاعب في اف8
	end		end
	end		end

	addCommandHandler("richplayers", listPlayersWithMoreMoneyThan)		addCommandHandler("richplayers", listPlayersWithMoreMoneyThan) -- كتابة الامر rechplayers لتشغيل الوظيفة
	</syntaxhighlight>		</syntaxhighlight>

Line 96:		Line 96:

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	function showPlayerMoney(thePlayer, command, playerName)		function showPlayerMoney(thePlayer, command, playerName) -- عمل وظيفة
	local result = executeSQLQuery("SELECT money FROM players WHERE name=?", playerName)		local result = executeSQLQuery("SELECT money FROM players WHERE name=?", playerName) -- جلب عدد المال من قاعدة players من خلال الاسم
	if(#result == 0) then		if(#result == 0) then -- نتأكد اذا الجدول = 0
	outputConsole("No player named " .. playerName .. " is registered.", thePlayer)		outputConsole("No player named " .. playerName .. " is registered.", thePlayer) -- يرسل ب اف8 للاعب ان اسم اللاعب ليس مسجل
	else		else -- اذا الجدول لا يساوي 0
	outputConsole("Money amount of player " .. playerName .. " is " .. result[1].money, thePlayer)		outputConsole("Money amount of player " .. playerName .. " is " .. result[1].money, thePlayer) -- يكتب اسم اللاعب وعدد المال المسجل في القاعده لديه
	end		end -- انهاء التحقق
	end		end -- انهاء الوظيفة
	addCommandHandler("playermoney", showPlayerMoney)		addCommandHandler("playermoney", showPlayerMoney) -- كتابة الامر playermoney لتشغيل الوظيفة
	</syntaxhighlight>		</syntaxhighlight>

Line 110:		Line 110:

	The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.		The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.

			By: [Abdo Nour]

	==See Also==		==See Also==

Yoodie at 10:01, 1 March 2020

2020-03-01T10:01:32Z

← Older revision		Revision as of 10:01, 1 March 2020
Line 114:		Line 114:
	{{Registry_functions}}		{{Registry_functions}}

	[[ru:~~ExecuteSQLQuery~~]]		[[ru:executeSQLQuery]]

Yoodie at 09:59, 1 March 2020

2020-03-01T09:59:14Z

← Older revision		Revision as of 09:59, 1 March 2020
Line 113:		Line 113:
	==See Also==		==See Also==
	{{Registry_functions}}		{{Registry_functions}}

			[[ru:ExecuteSQLQuery]]

Danilo at 05:03, 11 August 2019

2019-08-11T05:03:20Z

← Older revision		Revision as of 05:03, 11 August 2019
Line 3:		Line 3:

	This function executes an arbitrary SQL query and returns the result rows if there are any. It allows parameter binding for security (SQL injection is rendered impossible).		This function executes an arbitrary SQL query and returns the result rows if there are any. It allows parameter binding for security (SQL injection is rendered impossible).
			{{Note\|This function only acts upon registry.db. Use [[dbQuery]] to query a custom SQL database.}}
	~~'''NOTE:~~ This function only acts upon registry.db. Use [[dbQuery]] to query a custom SQL database.~~'''~~

	==Syntax==		==Syntax==

AncienT: /* Example */

2019-05-27T05:27:53Z

Example

← Older revision		Revision as of 05:27, 27 May 2019
Line 41:		Line 41:
	Example equivalents for executeSQLDelete:		Example equivalents for executeSQLDelete:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
			playerName = getPlayerName(thePlayer)
	executeSQLQuery("DELETE FROM players WHERE name=?", playerName)		executeSQLQuery("DELETE FROM players WHERE name=?", playerName)
	executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName)		executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName)
Line 53:		Line 54:
	Example equivalents for executeSQLSelect:		Example equivalents for executeSQLSelect:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
			playerName = getPlayerName(thePlayer)
	executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName )		executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName )
	executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName )		executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName )
Line 59:		Line 61:
	Example equivalents for executeSQLInsert:		Example equivalents for executeSQLInsert:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
			playerName = getPlayerName(thePlayer)
			colorName = "Blue"
			soundName = "sound.mp3"
	executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName )		executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName )
	executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName )		executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName )
Line 65:		Line 70:
	Example equivalents for executeSQLUpdate:		Example equivalents for executeSQLUpdate:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
			playerName = getPlayerName(thePlayer)
			colorName = "Blue"
			soundName = "sound.mp3"
	executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName )		executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName )
	executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName )		executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName )
Line 103:		Line 111:

	The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.		The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.


	==See Also==		==See Also==
	{{Registry_functions}}		{{Registry_functions}}

LordHenry at 13:37, 22 October 2018

2018-10-22T13:37:38Z

← Older revision		Revision as of 13:37, 22 October 2018
Line 4:		Line 4:
	This function executes an arbitrary SQL query and returns the result rows if there are any. It allows parameter binding for security (SQL injection is rendered impossible).		This function executes an arbitrary SQL query and returns the result rows if there are any. It allows parameter binding for security (SQL injection is rendered impossible).

	'''NOTE: This function only acts upon registry.db. Use dbQuery to query a custom SQL database.'''		'''NOTE: This function only acts upon registry.db. Use [[dbQuery]] to query a custom SQL database.'''

	==Syntax==		==Syntax==

Thisdp: Undo revision 59053 by Lizzalka (talk)

2018-09-09T06:00:35Z

Undo revision 59053 by Lizzalka (talk)

Show changes