xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-29 22:57:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: missed-out parameters escaping added

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-17 13:41:12 +02:00
parent 583312103e
commit 71dbed0571
1 changed files with 47 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Database.php
+47 -25
View File
@@ -229,27 +229,29 @@ class MYSQLi_DB {
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getVrefField($ref, $field){ function getVrefField($ref, $field) {
list($ref, $field) = $this->escape_input($ref, $field);
$q = "SELECT $field FROM " . TB_PREFIX . "vdata where wref = '$ref'"; $q = "SELECT $field FROM " . TB_PREFIX . "vdata where wref = '$ref'";
$result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink)); $result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink));
$dbarray = mysqli_fetch_array($result); $dbarray = mysqli_fetch_array($result);
return $dbarray[$field]; return $dbarray[$field];
} }
function getVrefCapital($ref){ function getVrefCapital($ref) {
list($ref) = $this->escape_input($ref);
$q = "SELECT * FROM " . TB_PREFIX . "vdata where owner = '$ref' and capital = 1"; $q = "SELECT * FROM " . TB_PREFIX . "vdata where owner = '$ref' and capital = 1";
$result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink)); $result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink));
$dbarray = mysqli_fetch_array($result); $dbarray = mysqli_fetch_array($result);
return $dbarray; return $dbarray;
} }
function getStarvation(){ function getStarvation() {
$q = "SELECT * FROM " . TB_PREFIX . "vdata where starv != 0 and owner != 3"; $q = "SELECT * FROM " . TB_PREFIX . "vdata where starv != 0 and owner != 3";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getUnstarvation(){ function getUnstarvation() {
$q = "SELECT * FROM " . TB_PREFIX . "vdata where starv = 0 and starvupdate = 0"; $q = "SELECT * FROM " . TB_PREFIX . "vdata where starv = 0 and starvupdate = 0";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
@@ -591,7 +593,8 @@ class MYSQLi_DB {
return $row[0]; return $row[0];
} }
public function countOasisTroops($vref){ public function countOasisTroops($vref) {
list($vref) = $this->escape_input($vref);
//count oasis troops: $troops_o //count oasis troops: $troops_o
$troops_o=0; $troops_o=0;
$o_unit2=mysqli_query($this->dblink,"select * from ".TB_PREFIX."units where `vref`='".$vref."'"); $o_unit2=mysqli_query($this->dblink,"select * from ".TB_PREFIX."units where `vref`='".$vref."'");
@@ -1781,7 +1784,8 @@ class MYSQLi_DB {
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getAllianceDipProfile($aid, $type){ function getAllianceDipProfile($aid, $type) {
list($aid, $type) = $this->escape_input($aid, $type);
$q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '$type' AND accepted = '1' OR alli2 = '$aid' AND type = '$type' AND accepted = '1'"; $q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '$type' AND accepted = '1' OR alli2 = '$aid' AND type = '$type' AND accepted = '1'";
$array = $this->query_return($q); $array = $this->query_return($q);
$text = ""; $text = "";
@@ -1800,7 +1804,8 @@ class MYSQLi_DB {
return $text; return $text;
} }
function getAllianceWar($aid){ function getAllianceWar($aid) {
list($aid) = $this->escape_input($aid);
$q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '3' OR alli2 = '$aid' AND type = '3' AND accepted = '1'"; $q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '3' OR alli2 = '$aid' AND type = '3' AND accepted = '1'";
$array = $this->query_return($q); $array = $this->query_return($q);
$text = ""; $text = "";
@@ -1819,13 +1824,15 @@ class MYSQLi_DB {
return $text; return $text;
} }
function getAllianceAlly($aid, $type){ function getAllianceAlly($aid, $type) {
list($aid, $type) = $this->escape_input($aid, $type);
$q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE (alli1 = '$aid' or alli2 = '$aid') AND (type = '$type' AND accepted = '1')"; $q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE (alli1 = '$aid' or alli2 = '$aid') AND (type = '$type' AND accepted = '1')";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getAllianceWar2($aid){ function getAllianceWar2($aid) {
list($aid) = $this->escape_input($aid);
$q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '3' OR alli2 = '$aid' AND type = '3' AND accepted = '1'"; $q = "SELECT * FROM ".TB_PREFIX."diplomacy WHERE alli1 = '$aid' AND type = '3' OR alli2 = '$aid' AND type = '3' AND accepted = '1'";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
@@ -2941,13 +2948,15 @@ class MYSQLi_DB {
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getUserByTribe($tribe){ function getUserByTribe($tribe) {
list($tribe) = $this->escape_input($tribe);
$q = "SELECT * FROM " . TB_PREFIX . "users where tribe = $tribe"; $q = "SELECT * FROM " . TB_PREFIX . "users where tribe = $tribe";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
} }
function getUserByAlliance($aid){ function getUserByAlliance($aid) {
list($aid) = $this->escape_input($aid);
$q = "SELECT * FROM " . TB_PREFIX . "users where alliance = $aid"; $q = "SELECT * FROM " . TB_PREFIX . "users where alliance = $aid";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
@@ -3039,7 +3048,8 @@ class MYSQLi_DB {
} }
} }
function getHeroField($uid,$field){ function getHeroField($uid,$field) {
list($uid,$field) = $this->escape_input($uid,$field);
$q = "SELECT * FROM ".TB_PREFIX."hero WHERE uid = $uid"; $q = "SELECT * FROM ".TB_PREFIX."hero WHERE uid = $uid";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result); return $this->mysqli_fetch_all($result);
@@ -3240,7 +3250,8 @@ class MYSQLi_DB {
return mysqli_query($this->dblink,$q); return mysqli_query($this->dblink,$q);
} }
function modifyUnit($vref, $array_unit, $array_amt, $array_mode){ function modifyUnit($vref, $array_unit, $array_amt, $array_mode) {
list($vref, $array_unit, $array_amt, $array_mode) = $this->escape_input($vref, $array_unit, $array_amt, $array_modes);
$i = -1; $i = -1;
$units=''; $units='';
$number = count($array_unit); $number = count($array_unit);
@@ -3973,24 +3984,28 @@ class MYSQLi_DB {
return mysqli_fetch_array($result); return mysqli_fetch_array($result);
} }
function getMovementById($id){ function getMovementById($id) {
list($id) = $this->escape_input($id);
$q = "SELECT * FROM ".TB_PREFIX."movement WHERE moveid = ".$id.""; $q = "SELECT * FROM ".TB_PREFIX."movement WHERE moveid = ".$id."";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
$array = $this->mysqli_fetch_all($result); $array = $this->mysqli_fetch_all($result);
return $array; return $array;
} }
function getLinks($id){ function getLinks($id) {
list($id) = $this->escape_input($id);
$q = 'SELECT * FROM `' . TB_PREFIX . 'links` WHERE `userid` = ' . $id . ' ORDER BY `pos` ASC'; $q = 'SELECT * FROM `' . TB_PREFIX . 'links` WHERE `userid` = ' . $id . ' ORDER BY `pos` ASC';
return mysqli_query($this->dblink,$q); return mysqli_query($this->dblink,$q);
} }
function removeLinks($id,$uid){ function removeLinks($id,$uid) {
list($id,$uid) = $this->escape_input($id,$uid);
$q = "DELETE FROM " . TB_PREFIX . "links WHERE `id` = ".$id." and `userid` = ".$uid.""; $q = "DELETE FROM " . TB_PREFIX . "links WHERE `id` = ".$id." and `userid` = ".$uid."";
return mysqli_query($this->dblink,$q); return mysqli_query($this->dblink,$q);
} }
function getVilFarmlist($wref){ function getVilFarmlist($wref) {
list($wref) = $this->escape_input($wref);
$q = 'SELECT * FROM ' . TB_PREFIX . 'farmlist WHERE wref = ' . $wref . ' ORDER BY wref ASC'; $q = 'SELECT * FROM ' . TB_PREFIX . 'farmlist WHERE wref = ' . $wref . ' ORDER BY wref ASC';
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
$dbarray = mysqli_fetch_array($result); $dbarray = mysqli_fetch_array($result);
@@ -4046,19 +4061,22 @@ class MYSQLi_DB {
return mysqli_query($this->dblink,$q); return mysqli_query($this->dblink,$q);
} }
function getArrayMemberVillage($uid){ function getArrayMemberVillage($uid) {
list($uid) = $this->escape_input($uid);
$q = 'SELECT a.wref, a.name, b.x, b.y from '.TB_PREFIX.'vdata AS a left join '.TB_PREFIX.'wdata AS b ON b.id = a.wref where owner = '.$uid.' order by capital DESC,pop DESC'; $q = 'SELECT a.wref, a.name, b.x, b.y from '.TB_PREFIX.'vdata AS a left join '.TB_PREFIX.'wdata AS b ON b.id = a.wref where owner = '.$uid.' order by capital DESC,pop DESC';
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
$array = $this->mysqli_fetch_all($result); $array = $this->mysqli_fetch_all($result);
return $array; return $array;
} }
function addPassword($uid, $npw, $cpw){ function addPassword($uid, $npw, $cpw) {
list($uid, $npw, $cpw) = $this->escape_input($uid, $npw, $cpw);
$q = "REPLACE INTO `" . TB_PREFIX . "password`(uid, npw, cpw) VALUES ($uid, '$npw', '$cpw')"; $q = "REPLACE INTO `" . TB_PREFIX . "password`(uid, npw, cpw) VALUES ($uid, '$npw', '$cpw')";
mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink)); mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink));
} }
function resetPassword($uid, $cpw){ function resetPassword($uid, $cpw) {
list($uid, $cpw) = $this->escape_input($uid, $cpw);
$q = "SELECT npw FROM `" . TB_PREFIX . "password` WHERE uid = $uid AND cpw = '$cpw' AND used = 0"; $q = "SELECT npw FROM `" . TB_PREFIX . "password` WHERE uid = $uid AND cpw = '$cpw' AND used = 0";
$result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink)); $result = mysqli_query($this->dblink,$q) or die(mysqli_error($database->dblink));
$dbarray = mysqli_fetch_array($result); $dbarray = mysqli_fetch_array($result);
@@ -4164,7 +4182,7 @@ class MYSQLi_DB {
$q = "SELECT * FROM " . TB_PREFIX . "general where shown = 1"; $q = "SELECT * FROM " . TB_PREFIX . "general where shown = 1";
$result = $this->query_return($q); $result = $this->query_return($q);
$attack = 0; $attack = 0;
foreach($result as $general){ foreach($result as $general) {
if(date("j. M",$time) == date("j. M",$general['time'])){ if(date("j. M",$time) == date("j. M",$general['time'])){
$attack += 1; $attack += 1;
} }
@@ -4301,19 +4319,22 @@ Function to vacation mode - by advocaite
References: References:
*****************************************/ *****************************************/
function setvacmode($uid,$days){ function setvacmode($uid,$days) {
list($uid,$days) = $this->escape_input($uid,$days);
$days1 =60*60*24*$days; $days1 =60*60*24*$days;
$time =time()+$days1; $time =time()+$days1;
$q ="UPDATE ".TB_PREFIX."users SET vac_mode = '1' , vac_time=".$time." WHERE id=".$uid.""; $q ="UPDATE ".TB_PREFIX."users SET vac_mode = '1' , vac_time=".$time." WHERE id=".$uid."";
$result =mysqli_query($this->dblink,$q); $result =mysqli_query($this->dblink,$q);
} }
function removevacationmode($uid){ function removevacationmode($uid) {
list($uid) = $this->escape_input($uid);
$q ="UPDATE ".TB_PREFIX."users SET vac_mode = '0' , vac_time='0' WHERE id=".$uid.""; $q ="UPDATE ".TB_PREFIX."users SET vac_mode = '0' , vac_time='0' WHERE id=".$uid."";
$result =mysqli_query($this->dblink,$q); $result =mysqli_query($this->dblink,$q);
} }
function getvacmodexy($wref){ function getvacmodexy($wref) {
list($wref) = $this->escape_input($wref);
$q = "SELECT id,oasistype,occupied FROM " . TB_PREFIX . "wdata where id = $wref"; $q = "SELECT id,oasistype,occupied FROM " . TB_PREFIX . "wdata where id = $wref";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
$dbarray = mysqli_fetch_array($result); $dbarray = mysqli_fetch_array($result);
@@ -4516,7 +4537,8 @@ References:
Made by: Shadow Made by: Shadow
***************************/ ***************************/
function checkAttack($wref, $toWref){ function checkAttack($wref, $toWref) {
list($wref, $toWref) = $this->escape_input($wref, $toWref);
$q = "SELECT * FROM " . TB_PREFIX . "movement, " . TB_PREFIX . "attacks where " . TB_PREFIX . "movement.from = $wref and " . TB_PREFIX . "movement.to = $toWref and " . TB_PREFIX . "movement.ref = " . TB_PREFIX . "attacks.id and " . TB_PREFIX . "movement.proc = 0 and " . TB_PREFIX . "movement.sort_type = 3 and (" . TB_PREFIX . "attacks.attack_type = 3 or " . TB_PREFIX . "attacks.attack_type = 4) ORDER BY endtime ASC"; $q = "SELECT * FROM " . TB_PREFIX . "movement, " . TB_PREFIX . "attacks where " . TB_PREFIX . "movement.from = $wref and " . TB_PREFIX . "movement.to = $toWref and " . TB_PREFIX . "movement.ref = " . TB_PREFIX . "attacks.id and " . TB_PREFIX . "movement.proc = 0 and " . TB_PREFIX . "movement.sort_type = 3 and (" . TB_PREFIX . "attacks.attack_type = 3 or " . TB_PREFIX . "attacks.attack_type = 4) ORDER BY endtime ASC";
$result = mysqli_query($this->dblink,$q); $result = mysqli_query($this->dblink,$q);
if(mysqli_num_rows($result)) { if(mysqli_num_rows($result)) {