Modules/MySQL/MysqlSafeString - Revision history

Sebassje at 20:48, 29 September 2009

2009-09-29T20:48:46Z

← Older revision		Revision as of 20:48, 29 September 2009
Line 7:		Line 7:

	==Syntax==		==Syntax==
	<syntaxhighlight lang="lua">string mysqlSafeString ( mysql db, string query )</syntaxhighlight>		<syntaxhighlight lang="lua">string mysqlSafeString ( mysql mysqlobj, string query )</syntaxhighlight>

	===Required Arguments===		===Required Arguments===
	*'''db''' : A ''mysql'' object created by [[Modules/MySQL/MysqlCreate\|mysqlCreate]]		*'''mysqlobj''' : A ''mysql'' object created by [[Modules/MySQL/MysqlCreate\|mysqlCreate]]
	*'''query''' : The MySQL query that needs to be escasped		*'''query''' : The MySQL query that needs to be escasped

IJs at 22:01, 29 January 2007

2007-01-29T22:01:16Z

← Older revision		Revision as of 22:01, 29 January 2007
Line 2:		Line 2:
	{{ModuleFunction\|MySQL}}		{{ModuleFunction\|MySQL}}

	This function escapes a given string so it's safe to pass as a query to [[mysqlQuery]]. Please use this as sanity checking function to prevent bad things like SQL injection.		This function escapes a given string so it's safe to pass as a query to [[Modules/MySQL/MysqlQuery\|mysqlQuery]]. Please use this as sanity checking function to prevent bad things like SQL injection.

	The function needs an already established connection to a MySQL database, because it reads out the character set from that database to escape the string.		The function needs an already established connection to a MySQL database, because it reads out the character set from that database to escape the string.
Line 10:		Line 10:

	===Required Arguments===		===Required Arguments===
	*'''db''' : A ''mysql'' object created by [[mysqlCreate]]		*'''db''' : A ''mysql'' object created by [[Modules/MySQL/MysqlCreate\|mysqlCreate]]
	*'''query''' : The MySQL query that needs to be escasped		*'''query''' : The MySQL query that needs to be escasped

IJs at 21:59, 29 January 2007

2007-01-29T21:59:09Z

New page

__NOTOC__
{{ModuleFunction|MySQL}}

This function escapes a given string so it's safe to pass as a query to [[mysqlQuery]]. Please use this as sanity checking function to prevent bad things like SQL injection.

The function needs an already established connection to a MySQL database, because it reads out the character set from that database to escape the string.

==Syntax==
<syntaxhighlight lang="lua">string mysqlSafeString ( mysql db, string query )</syntaxhighlight>

===Required Arguments===
*'''db''' : A ''mysql'' object created by [[mysqlCreate]]
*'''query''' : The MySQL query that needs to be escasped

===Optional Arguments===

''None''

==Example==
<syntaxhighlight lang="lua">
function onMySQLOpen ( result )
if ( result ) then
outputServerLog ( "MySQL connection established." )
-- do the safe query
local safe = mysqlSafeString ( db, some_string_passed_by_a_user )
mysqlQuery ( db, "onMySQLResult", "SELECT ".. safe .." FROM test" )
else
outputServerLog ( "MySQL connection failed." )
end
end

function mysqltest ()
db = mysqlCreate ()
mysqlOpen ( db, "onMySQLOpen", "localhost", "bastage", "bastage_pw", "test", 3306 )
end
</syntaxhighlight>