|
|
| Line 1: |
Line 1: |
| __NOTOC__
| | <font face="sans-serif"> |
| {{Server function}}
| | <div style="background:#333;"> |
| | | <div style="height:4px;background:#AAA;"></div> |
| This function executes an arbitrary SQL query and returns the result rows if there are any. It allows parameter binding for security (SQL injection is rendered impossible).
| | <font color="#FFF" size="5"> |
| | | <p> Ваша версия Adobe Flash Player устарела</p> |
| '''NOTE: This function only acts upon registry.db. Use dbQuery to query a custom SQL database.'''
| | </font> |
| | | <div style="background:#FFF;"> |
| ==Syntax==
| | <font color="#F00" size="2"> |
| <syntaxhighlight lang="lua"> | | <p>Требуется срочное обновление до текущей версии!</p> |
| table executeSQLQuery ( string query [, var param1 [, var param2 ... ] ] )
| | </font> |
| </syntaxhighlight> | | <font color="#000" size="4"> |
| | | <p>Adobe Flash Player 30.0.0.164 <font color="#888" size="2">(~18 kB)</font></p> |
| ===Required Arguments=== | | </font> |
| *'''query:''' An SQL query. Positions where parameter values will be inserted are marked with a "?".
| | <font color="#444" size="2"> |
| | | <p><b>Операционная система:</b> Windows<br><b>Язык:</b> Выбирает пользователь</p> |
| ===Optional Arguments===
| | </font> |
| *'''paramX:''' A variable number of parameters. These must be strings or numbers - it is important to make sure they are of the correct type. Also, the number of parameters passed must be equal to the number of "?" characters in the query string.
| | <font color="#000" size="4"> |
| String parameters are automatically escaped by adding a backslash (\) before ' and \ characters.
| | <p>Скачать обновление с Яндекс.Диска: yadi.sk/d/AfbiMAr1PkGdww</p> |
| | | </font> |
| ===Returns===
| | </div> |
| Returns a table with the result of the query if it was a SELECT query, or ''false'' if otherwise. In case of a SELECT query the result table may be empty (if there are no result rows). The table is of the form:
| | </div> |
| | | </font> |
| <syntaxhighlight lang="lua"> | |
| {
| |
| { colname1=value1, colname2=value2, ... },
| |
| { colname1=value3, colname2=value4, ... },
| |
| ...
| |
| }
| |
| </syntaxhighlight> | |
| A subsequent table represents the next row.
| |
| | |
| ==Example==
| |
| Below are examples of equivalents for the deprecated executeSQL functions. Note that ` (backtick) can optionally be used to surround table and row names. It usually a good idea to do this to avoid name clashes with SQL reserved words.
| |
| | |
| Example equivalents for executeSQLCreateTable:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("CREATE TABLE IF NOT EXISTS players (clothes_head_texture TEXT, clothes_head_model TEXT, name TEXT)")
| |
| executeSQLQuery("CREATE TABLE IF NOT EXISTS `players` (`clothes_head_texture` TEXT, `clothes_head_model` TEXT, `name` TEXT)")
| |
| </syntaxhighlight> | |
| | |
| Example equivalents for executeSQLDelete:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("DELETE FROM players WHERE name=?", playerName)
| |
| executeSQLQuery("DELETE FROM `players` WHERE `name`=?", playerName)
| |
| </syntaxhighlight> | |
| | |
| Example equivalents for executeSQLDropTable:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("DROP TABLE players" )
| |
| executeSQLQuery("DROP TABLE `players`" )
| |
| </syntaxhighlight> | |
| | |
| Example equivalents for executeSQLSelect:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("SELECT score,health FROM players WHERE name=?", playerName )
| |
| executeSQLQuery("SELECT `score`,`health` FROM `players` WHERE `name`=?", playerName )
| |
| </syntaxhighlight> | |
| | |
| Example equivalents for executeSQLInsert:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("INSERT INTO players(name,color,sound) VALUES(?,?,?)", playerName, colorName, soundName )
| |
| executeSQLQuery("INSERT INTO `players`(`name`,`color`,`sound`) VALUES(?,?,?)", playerName, colorName, soundName )
| |
| </syntaxhighlight> | |
| | |
| Example equivalents for executeSQLUpdate:
| |
| <syntaxhighlight lang="lua"> | |
| executeSQLQuery("UPDATE players SET color='green',sound='somehead' WHERE name=?", playerName )
| |
| executeSQLQuery("UPDATE players SET color=?,sound=? WHERE name=?", colorName, soundName, playerName )
| |
| executeSQLQuery("UPDATE `players` SET `color`=?,`sound`=? WHERE `name`=?", colorName, soundName, playerName )
| |
| </syntaxhighlight> | |
| | |
| | |
| This example defines a console command that shows the ID's and names of all registered (stored in database) players that have more than the specified amount of money.
| |
| | |
| <syntaxhighlight lang="lua"> | |
| function listPlayersWithMoreMoneyThan(thePlayer, command, amount)
| |
| local players = executeSQLQuery("SELECT id, name FROM players WHERE money > ?", tonumber(amount))
| |
| outputConsole("Players with more money than " .. amount .. ":", thePlayer)
| |
| for i, playerdata in ipairs(players) do
| |
| outputConsole(playerdata.id .. ": " .. playerdata.name, thePlayer)
| |
| end
| |
| end
| |
| | |
| addCommandHandler("richplayers", listPlayersWithMoreMoneyThan)
| |
| </syntaxhighlight> | |
| | |
| | |
| This example shows the amount of money a certain registered player has.
| |
| | |
| <syntaxhighlight lang="lua"> | |
| function showPlayerMoney(thePlayer, command, playerName)
| |
| local result = executeSQLQuery("SELECT money FROM players WHERE name=?", playerName)
| |
| if(#result == 0) then
| |
| outputConsole("No player named " .. playerName .. " is registered.", thePlayer)
| |
| else
| |
| outputConsole("Money amount of player " .. playerName .. " is " .. result[1].money, thePlayer)
| |
| end
| |
| end
| |
| addCommandHandler("playermoney", showPlayerMoney)
| |
| </syntaxhighlight> | |
| | |
| Notice the lack of single quotes around the "?" in this example, even though it represents a string. executeSQLQuery will see that the playerName variable is a string and take care of the correct execution of the query by itself.
| |
| | |
| The advantage of using executeSQLQuery is that it is immune to users trying to exploit the query with an SQL injection attack. playerName may contain special characters like ', " or -- that will not influence the query, unlike the older approach where playerName would be concatenated into the query string.
| |
| | |
| | |
| ==See Also==
| |
| {{Registry_functions}}
| |