cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-25 06:00:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Removes extra sql sanitize procs in favor of sanitizeSQL()

Browse Source
This commit is contained in:
MrStonedOne
2014-10-29 04:12:07 -07:00
parent 3eccc3a709
commit 8a064ee545
4 changed files with 15 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/research/message_server.dm
+7 -13
View File
@@ -290,17 +290,11 @@ var/obj/machinery/blackbox_recorder/blackbox
var/DBQuery/query_insert = dbcon.NewQuery(sql)
query_insert.Execute()
// Sanitize inputs to avoid SQL injection attacks
proc/sql_sanitize_text(var/text)
text = replacetext(text, "'", "''")
text = replacetext(text, ";", "")
text = replacetext(text, "&", "")
return text
proc/feedback_set(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
variable = sanitizeSQL(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
@@ -311,7 +305,7 @@ proc/feedback_set(var/variable,var/value)
proc/feedback_inc(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
variable = sanitizeSQL(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
@@ -322,7 +316,7 @@ proc/feedback_inc(var/variable,var/value)
proc/feedback_dec(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
variable = sanitizeSQL(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
@@ -333,8 +327,8 @@ proc/feedback_dec(var/variable,var/value)
proc/feedback_set_details(var/variable,var/details)
if(!blackbox) return
variable = sql_sanitize_text(variable)
details = sql_sanitize_text(details)
variable = sanitizeSQL(variable)
details = sanitizeSQL(details)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
@@ -345,8 +339,8 @@ proc/feedback_set_details(var/variable,var/details)
proc/feedback_add_details(var/variable,var/details)
if(!blackbox) return
variable = sql_sanitize_text(variable)
details = sql_sanitize_text(details)
variable = sanitizeSQL(variable)
details = sanitizeSQL(details)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)