Async SQL + SSdbcore (#15007)

* Initial Commit - Async SQL

* First batch of queries

* More progress

* Nukes DB Polls

* More work

* oops

* One push

* Notes work now

* Ok these work

* Watchlist done

* Async Bans!

* Async Permissions

* Async client procs

* I officially hate preference datums

* Also these

* Async Custom Items

* Async Karma

* Async Library

* Async TOS

* Cleans out the old SQL code

* CI Sanity

* Apparently MySQL doesnt support this

* What about this

* Maybe this

* Review pass 1

* This too

* Fixes job ban loading

* Fix undeleted queries

* Prevents sensitive queries being logged

* Documentation + tweaks

* Adds a verb to force reconnect the DB

* More review tweaks

* Farie tweaks

* Fixes this

code/modules/admin/IsBanned.dm

@@ -1,12 +1,6 @@
 //Blocks an attempt to connect before even creating our client datum thing.
 /world/IsBanned(key, address, computer_id, type, check_ipintel = TRUE)
 
-	if(!config.ban_legacy_system)
-		if(address)
-			address = sanitizeSQL(address)
-		if(computer_id)
-			computer_id = sanitizeSQL(computer_id)
-
 	if(!key || !address || !computer_id)
 		log_adminwarn("Failed Login (invalid data): [key] [address]-[computer_id]")
 		return list("reason"="invalid login data", "desc"="Error: Could not check ban status, please try again. Error message: Your computer provided invalid or blank information to the server on connection (BYOND Username, IP, and Computer ID). Provided information for reference: Username: '[key]' IP: '[address]' Computer ID: '[computer_id]'. If you continue to get this error, please restart byond or contact byond support.")
@@ -59,21 +53,33 @@
 	else
 		var/ckeytext = ckey(key)
 
-		if(!establish_db_connection())
+		if(!SSdbcore.IsConnected())
 			log_world("Ban database connection failure. Key [ckeytext] not checked")
 			return
 
+		var/list/sql_query_params = list(
+			"ckeytext" = ckeytext
+		)
+
 		var/ipquery = ""
 		var/cidquery = ""
 		if(address)
-			ipquery = " OR ip = '[address]' "
+			ipquery = " OR ip=:ip "
+			sql_query_params["ip"] = address
 
 		if(computer_id)
-			cidquery = " OR computerid = '[computer_id]' "
+			cidquery = " OR computerid=:cid "
+			sql_query_params["cid"] = computer_id
 
-		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT ckey, ip, computerid, a_ckey, reason, expiration_time, duration, bantime, bantype FROM [format_table_name("ban")] WHERE (ckey = '[ckeytext]' [ipquery] [cidquery]) AND (bantype = 'PERMABAN' OR bantype = 'ADMIN_PERMABAN' OR ((bantype = 'TEMPBAN' OR bantype = 'ADMIN_TEMPBAN') AND expiration_time > Now())) AND isnull(unbanned)")
+		var/datum/db_query/query = SSdbcore.NewQuery({"
+		SELECT ckey, ip, computerid, a_ckey, reason, expiration_time, duration, bantime, bantype FROM [format_table_name("ban")]
+		WHERE (ckey=:ckeytext [ipquery] [cidquery]) AND (bantype = 'PERMABAN' OR bantype = 'ADMIN_PERMABAN'
+		OR ((bantype = 'TEMPBAN' OR bantype = 'ADMIN_TEMPBAN') AND expiration_time > Now())) AND isnull(unbanned)"}, sql_query_params)
 
-		query.Execute()
+		if(!query.warn_execute())
+			message_admins("Failed to do a DB ban check for [ckeytext]. You have been warned.")
+			qdel(query)
+			return
 
 		while(query.NextRow())
 			var/pckey = query.item[1]
@@ -113,7 +119,9 @@
 			. = list("reason"="[bantype]", "desc"="[desc]")
 
 			log_adminwarn("Failed Login: [key] [computer_id] [address] - Banned [.["reason"]]")
+			qdel(query)
 			return .
+		qdel(query)
 
 	. = ..()	//default pager ban stuff
 	if(.)

code/modules/admin/admin_memo.dm

@@ -3,7 +3,7 @@
 	set category = "Server"
 	if(!check_rights(R_SERVER))
 		return
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		to_chat(src, "<span class='danger'>Failed to establish database connection.</span>")
 		return
 	var/memotask = input(usr,"Choose task.","Memo") in list("Show","Write","Edit","Remove")
@@ -16,78 +16,113 @@
 		return
 	if(!task)
 		return
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		to_chat(src, "<span class='danger'>Failed to establish database connection.</span>")
 		return
-	var/sql_ckey = sanitizeSQL(src.ckey)
 	switch(task)
 		if("Write")
-			var/DBQuery/query_memocheck = GLOB.dbcon.NewQuery("SELECT ckey FROM [format_table_name("memo")] WHERE ckey = '[sql_ckey]'")
-			if(!query_memocheck.Execute())
-				var/err = query_memocheck.ErrorMsg()
-				log_game("SQL ERROR obtaining ckey from memo table. Error : \[[err]\]\n")
+			var/datum/db_query/query_memocheck = SSdbcore.NewQuery(
+				"SELECT ckey FROM [format_table_name("memo")] WHERE ckey=:ckey",
+				list("ckey" = ckey)
+			)
+
+			if(!query_memocheck.warn_execute())
+				qdel(query_memocheck)
 				return
+
 			if(query_memocheck.NextRow())
 				to_chat(src, "You already have set a memo.")
+				qdel(query_memocheck)
 				return
-			var/memotext = input(src,"Write your Memo","Memo") as message
+
+			qdel(query_memocheck)
+			var/memotext = input(src, "Write your Memo", "Memo") as message
 			if(!memotext)
 				return
-			memotext = sanitizeSQL(memotext)
-			var/timestamp = SQLtime()
-			var/DBQuery/query_memoadd = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("memo")] (ckey, memotext, timestamp) VALUES ('[sql_ckey]', '[memotext]', '[timestamp]')")
-			if(!query_memoadd.Execute())
-				var/err = query_memoadd.ErrorMsg()
-				log_game("SQL ERROR adding new memo. Error : \[[err]\]\n")
+
+			var/datum/db_query/query_memoadd = SSdbcore.NewQuery(
+				"INSERT INTO [format_table_name("memo")] (ckey, memotext, timestamp) VALUES (:ckey, :memotext, NOW())",
+				list(
+					"ckey" = ckey,
+					"memotext" = memotext
+				)
+			)
+
+			if(!query_memoadd.warn_execute())
+				qdel(query_memoadd)
 				return
+
 			log_admin("[key_name(src)] has set a memo: [memotext]")
 			message_admins("[key_name_admin(src)] has set a memo:<br>[memotext]")
+			qdel(query_memoadd)
+
 		if("Edit")
-			var/DBQuery/query_memolist = GLOB.dbcon.NewQuery("SELECT ckey FROM [format_table_name("memo")]")
-			if(!query_memolist.Execute())
-				var/err = query_memolist.ErrorMsg()
-				log_game("SQL ERROR obtaining ckey from memo table. Error : \[[err]\]\n")
+			var/datum/db_query/query_memolist = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("memo")]")
+
+			if(!query_memolist.warn_execute())
+				qdel(query_memolist)
 				return
+
 			var/list/memolist = list()
 			while(query_memolist.NextRow())
 				var/lkey = query_memolist.item[1]
 				memolist += "[lkey]"
-			if(!memolist.len)
+
+			qdel(query_memolist)
+			if(!length(memolist))
 				to_chat(src, "No memos found in database.")
 				return
+
 			var/target_ckey = input(src, "Select whose memo to edit", "Select memo") as null|anything in memolist
 			if(!target_ckey)
 				return
-			var/target_sql_ckey = sanitizeSQL(target_ckey)
-			var/DBQuery/query_memofind = GLOB.dbcon.NewQuery("SELECT memotext FROM [format_table_name("memo")] WHERE ckey = '[target_sql_ckey]'")
-			if(!query_memofind.Execute())
-				var/err = query_memofind.ErrorMsg()
-				log_game("SQL ERROR obtaining memotext from memo table. Error : \[[err]\]\n")
+
+			var/datum/db_query/query_memofind = SSdbcore.NewQuery(
+				"SELECT memotext FROM [format_table_name("memo")] WHERE ckey=:ckey",
+				list("ckey" = target_ckey)
+			)
+
+			if(!query_memofind.warn_execute())
+				qdel(query_memofind)
 				return
+
 			if(query_memofind.NextRow())
 				var/old_memo = query_memofind.item[1]
 				var/new_memo = input("Input new memo", "New Memo", "[old_memo]", null) as message
 				if(!new_memo)
+					qdel(query_memofind)
 					return
-				new_memo = sanitizeSQL(new_memo)
-				var/edit_text = "Edited by [sql_ckey] on [SQLtime()] from<br>[old_memo]<br>to<br>[new_memo]<hr>"
-				edit_text = sanitizeSQL(edit_text)
-				var/DBQuery/update_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("memo")] SET memotext = '[new_memo]', last_editor = '[sql_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE ckey = '[target_sql_ckey]'")
-				if(!update_query.Execute())
-					var/err = update_query.ErrorMsg()
-					log_game("SQL ERROR editing memo. Error : \[[err]\]\n")
+
+				var/edit_text = "Edited by [target_ckey] on [SQLtime()] from<br>[old_memo]<br>to<br>[new_memo]<hr>"
+
+				var/datum/db_query/update_query = SSdbcore.NewQuery(
+					"UPDATE [format_table_name("memo")] SET memotext=:newmemo, last_editor=:lasteditor, edits=CONCAT(IFNULL(edits,''),:edittext) WHERE ckey=:targetckey",
+					list(
+						"newmemo" = new_memo,
+						"lasteditor" = ckey,
+						"edittext" = edit_text,
+						"targetckey" = target_ckey
+					)
+				)
+
+				if(!update_query.warn_execute())
+					qdel(update_query)
+					qdel(query_memofind)
 					return
-				if(target_sql_ckey == sql_ckey)
+
+				if(target_ckey == ckey)
 					log_admin("[key_name(src)] has edited their memo from \"[old_memo]\" to \"[new_memo]\"")
 					message_admins("[key_name_admin(src)] has edited their memo from \"[old_memo]]\" to \"[new_memo]\"")
 				else
-					log_admin("[key_name(src)] has edited [target_sql_ckey]'s memo from \"[old_memo]\" to \"[new_memo]\"")
-					message_admins("[key_name_admin(src)] has edited [target_sql_ckey]'s memo from \"[old_memo]\" to \"[new_memo]\"")
+					log_admin("[key_name(src)] has edited [target_ckey]'s memo from \"[old_memo]\" to \"[new_memo]\"")
+					message_admins("[key_name_admin(src)] has edited [target_ckey]'s memo from \"[old_memo]\" to \"[new_memo]\"")
+				qdel(update_query)
+			qdel(query_memofind)
+
 		if("Show")
-			var/DBQuery/query_memoshow = GLOB.dbcon.NewQuery("SELECT ckey, memotext, timestamp, last_editor FROM [format_table_name("memo")]")
-			if(!query_memoshow.Execute())
-				var/err = query_memoshow.ErrorMsg()
-				log_game("SQL ERROR obtaining ckey, memotext, timestamp, last_editor from memo table. Error : \[[err]\]\n")
+			var/datum/db_query/query_memoshow = SSdbcore.NewQuery("SELECT ckey, memotext, timestamp, last_editor FROM [format_table_name("memo")]")
+			if(!query_memoshow.warn_execute())
+				qdel(query_memoshow)
 				return
 			var/output = null
 			while(query_memoshow.NextRow())
@@ -103,31 +138,41 @@
 				to_chat(src, output)
 			else if(!silent)
 				to_chat(src, "No memos found in database.")
+			qdel(query_memoshow)
+
 		if("Remove")
-			var/DBQuery/query_memodellist = GLOB.dbcon.NewQuery("SELECT ckey FROM [format_table_name("memo")]")
-			if(!query_memodellist.Execute())
-				var/err = query_memodellist.ErrorMsg()
-				log_game("SQL ERROR obtaining ckey from memo table. Error : \[[err]\]\n")
+			var/datum/db_query/query_memodellist = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("memo")]")
+			if(!query_memodellist.warn_execute())
+				qdel(query_memodellist)
 				return
+
 			var/list/memolist = list()
 			while(query_memodellist.NextRow())
 				var/ckey = query_memodellist.item[1]
 				memolist += "[ckey]"
+
+			qdel(query_memodellist)
 			if(!memolist.len)
 				to_chat(src, "No memos found in database.")
 				return
+
 			var/target_ckey = input(src, "Select whose memo to delete", "Select memo") as null|anything in memolist
 			if(!target_ckey)
 				return
-			var/target_sql_ckey = sanitizeSQL(target_ckey)
-			var/DBQuery/query_memodel = GLOB.dbcon.NewQuery("DELETE FROM [format_table_name("memo")] WHERE ckey = '[target_sql_ckey]'")
-			if(!query_memodel.Execute())
-				var/err = query_memodel.ErrorMsg()
-				log_game("SQL ERROR removing memo. Error : \[[err]\]\n")
+
+			var/datum/db_query/query_memodel = SSdbcore.NewQuery(
+				"DELETE FROM [format_table_name("memo")] WHERE ckey=:ckey",
+				list("ckey" = target_ckey)
+			)
+
+			if(!query_memodel.warn_execute())
+				qdel(query_memodel)
 				return
-			if(target_sql_ckey == sql_ckey)
+
+			qdel(query_memodel)
+			if(target_ckey == ckey)
 				log_admin("[key_name(src)] has removed their memo.")
 				message_admins("[key_name_admin(src)] has removed their memo.")
 			else
-				log_admin("[key_name(src)] has removed [target_sql_ckey]'s memo.")
-				message_admins("[key_name_admin(src)] has removed [target_sql_ckey]'s memo.")
+				log_admin("[key_name(src)] has removed [target_ckey]'s memo.")
+				message_admins("[key_name_admin(src)] has removed [target_ckey]'s memo.")

code/modules/admin/admin_ranks.dm

@@ -111,16 +111,17 @@ GLOBAL_PROTECT(admin_ranks) // this shit is being protected for obvious reasons
 
 	else
 		//The current admin system uses SQL
-
-		establish_db_connection()
-		if(!GLOB.dbcon.IsConnected())
+		if(!SSdbcore.IsConnected())
 			log_world("Failed to connect to database in load_admins(). Reverting to legacy system.")
 			config.admin_legacy_system = 1
 			load_admins()
 			return
 
-		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT ckey, rank, level, flags FROM [format_table_name("admin")]")
-		query.Execute()
+		var/datum/db_query/query = SSdbcore.NewQuery("SELECT ckey, rank, level, flags FROM [format_table_name("admin")]")
+		if(!query.warn_execute())
+			qdel(query)
+			return
+
 		while(query.NextRow())
 			var/ckey = query.item[1]
 			var/rank = query.item[2]
@@ -135,6 +136,9 @@ GLOBAL_PROTECT(admin_ranks) // this shit is being protected for obvious reasons
 
 			//find the client for a ckey if they are connected and associate them with the new admin datum
 			D.associate(GLOB.directory[ckey])
+
+		qdel(query)
+
 		if(!GLOB.admin_datums)
 			log_world("The database query in load_admins() resulted in no admins being added to the list. Reverting to legacy system.")
 			config.admin_legacy_system = 1

code/modules/admin/admin_verbs.dm

@@ -168,7 +168,8 @@ GLOBAL_LIST_INIT(admin_verbs_debug, list(
 	/client/proc/jump_to_ruin,
 	/client/proc/toggle_medal_disable,
 	/client/proc/uid_log,
-	/client/proc/visualise_active_turfs
+	/client/proc/visualise_active_turfs,
+	/client/proc/reestablish_db_connection
 	))
 GLOBAL_LIST_INIT(admin_verbs_possess, list(
 	/proc/possess,
@@ -176,7 +177,6 @@ GLOBAL_LIST_INIT(admin_verbs_possess, list(
 	))
 GLOBAL_LIST_INIT(admin_verbs_permissions, list(
 	/client/proc/edit_admin_permissions,
-	/client/proc/create_poll,
 	/client/proc/big_brother
 	))
 GLOBAL_LIST_INIT(admin_verbs_rejuv, list(
@@ -691,15 +691,23 @@ GLOBAL_LIST_INIT(admin_verbs_ticket, list(
 			continue
 
 	else
-		if(!GLOB.dbcon.IsConnected())
-			message_admins("Warning, MySQL database is not connected.")
+		if(!SSdbcore.IsConnected())
 			to_chat(src, "Warning, MYSQL database is not connected.")
 			return
-		var/sql_ckey = sanitizeSQL(ckey)
-		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT rank FROM [format_table_name("admin")] WHERE ckey = '[sql_ckey]'")
-		query.Execute()
-		while(query.NextRow())
-			rank = ckeyEx(query.item[1])
+
+		var/datum/db_query/rank_read = SSdbcore.NewQuery(
+			"SELECT rank FROM [format_table_name("admin")] WHERE ckey=:ckey",
+			list("ckey" = ckey)
+		)
+
+		if(!rank_read.warn_execute())
+			qdel(rank_read)
+			return FALSE
+
+		while(rank_read.NextRow())
+			rank = ckeyEx(rank_read.item[1])
+
+		qdel(rank_read)
 	if(!D)
 		if(config.admin_legacy_system)
 			if(GLOB.admin_ranks[rank] == null)
@@ -709,24 +717,38 @@ GLOBAL_LIST_INIT(admin_verbs_ticket, list(
 
 			D = new(rank, GLOB.admin_ranks[rank], ckey)
 		else
-			var/sql_ckey = sanitizeSQL(ckey)
-			var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT ckey, rank, flags FROM [format_table_name("admin")] WHERE ckey = '[sql_ckey]'")
-			query.Execute()
-			while(query.NextRow())
-				var/admin_ckey = query.item[1]
-				var/admin_rank = query.item[2]
-				var/flags = query.item[3]
+			if(!SSdbcore.IsConnected())
+				to_chat(src, "Warning, MYSQL database is not connected.")
+				return
+
+			var/datum/db_query/admin_read = SSdbcore.NewQuery(
+				"SELECT ckey, rank, flags FROM [format_table_name("admin")] WHERE ckey=:ckey",
+				list("ckey" = ckey)
+			)
+
+			if(!admin_read.warn_execute())
+				qdel(admin_read)
+				return FALSE
+
+			while(admin_read.NextRow())
+				var/admin_ckey = admin_read.item[1]
+				var/admin_rank = admin_read.item[2]
+				var/flags = admin_read.item[3]
 				if(!admin_ckey)
 					to_chat(src, "Error while re-adminning, ckey [admin_ckey] was not found in the admin database.")
+					qdel(admin_read)
 					return
 				if(admin_rank == "Removed") //This person was de-adminned. They are only in the admin list for archive purposes.
 					to_chat(src, "Error while re-adminning, ckey [admin_ckey] is not an admin.")
+					qdel(admin_read)
 					return
 
 				if(istext(flags))
 					flags = text2num(flags)
 				D = new(admin_rank, flags, ckey)
 
+			qdel(admin_read)
+
 		var/client/C = GLOB.directory[ckey]
 		D.associate(C)
 		message_admins("[key_name_admin(usr)] re-adminned themselves.")

code/modules/admin/banappearance.dm

@@ -39,7 +39,7 @@ DEBUG
 
 	appearance_loadbanfile()
 */
-
+// AA 2020-11-25: This entire proc isnt even called. What the actual fuck.
 /proc/appearance_loadbanfile()
 	if(config.ban_legacy_system)
 		var/savefile/S=new("data/appearance_full.ban")
@@ -51,21 +51,26 @@ DEBUG
 			GLOB.appearance_keylist=list()
 			log_admin("appearance_keylist was empty")
 	else
-		if(!establish_db_connection())
+		if(!SSdbcore.IsConnected())
 			log_world("Database connection failed. Reverting to the legacy ban system.")
 			config.ban_legacy_system = 1
 			appearance_loadbanfile()
 			return
 
 		//appearance bans
-		var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT ckey FROM [format_table_name("ban")] WHERE bantype = 'APPEARANCE_BAN' AND NOT unbanned = 1")
-		query.Execute()
+		var/datum/db_query/appearanceban_query = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("ban")] WHERE bantype = 'APPEARANCE_BAN' AND NOT unbanned = 1")
 
-		while(query.NextRow())
-			var/ckey = query.item[1]
+		if(!appearanceban_query.warn_execute())
+			qdel(appearanceban_query)
+			return FALSE
+
+		while(appearanceban_query.NextRow())
+			var/ckey = appearanceban_query.item[1]
 
 			GLOB.appearance_keylist.Add("[ckey]")
 
+		qdel(appearanceban_query)
+
 /proc/appearance_savebanfile()
 	var/savefile/S=new("data/appearance_full.ban")
 	to_chat(S["keys[0]"], GLOB.appearance_keylist)

code/modules/admin/banjob.dm

@@ -59,34 +59,42 @@ GLOBAL_DATUM_INIT(jobban_regex, /regex, regex("(\[\\S]+) - (\[^#]+\[^# ])(?: ##
 			else
 				log_runtime(EXCEPTION("Skipping malformed job ban: [s]"))
 	else
-		if(!establish_db_connection())
+		if(!SSdbcore.IsConnected())
 			log_world("Database connection failed. Reverting to the legacy ban system.")
 			config.ban_legacy_system = 1
 			jobban_loadbanfile()
 			return
 
 		//Job permabans
-		var/DBQuery/permabans = GLOB.dbcon.NewQuery("SELECT ckey, job FROM [format_table_name("ban")] WHERE bantype = 'JOB_PERMABAN' AND isnull(unbanned)")
-		permabans.Execute()
-		// Job tempbans
-		var/DBQuery/tempbans = GLOB.dbcon.NewQuery("SELECT ckey, job FROM [format_table_name("ban")] WHERE bantype = 'JOB_TEMPBAN' AND isnull(unbanned) AND expiration_time > Now()")
-		tempbans.Execute()
+		var/datum/db_query/permabans = SSdbcore.NewQuery("SELECT ckey, job FROM [format_table_name("ban")] WHERE bantype = 'JOB_PERMABAN' AND isnull(unbanned)")
 
-		while(TRUE)
-			var/ckey
-			var/job
-			if(permabans.NextRow())
-				ckey = permabans.item[1]
-				job = permabans.item[2]
-			else if(tempbans.NextRow())
-				ckey = tempbans.item[1]
-				job = tempbans.item[2]
-			else
-				break
+		if(!permabans.warn_execute())
+			qdel(permabans)
+			return FALSE
 
+		while(permabans.NextRow())
+			var/ckey = permabans.item[1]
+			var/job = permabans.item[2]
 			GLOB.jobban_keylist.Add("[ckey] - [job]")
 			jobban_assoc_insert(ckey, job)
 
+		qdel(permabans)
+
+		// Job tempbans
+		var/datum/db_query/tempbans = SSdbcore.NewQuery("SELECT ckey, job FROM [format_table_name("ban")] WHERE bantype = 'JOB_TEMPBAN' AND isnull(unbanned) AND expiration_time > Now()")
+
+		if(!tempbans.warn_execute())
+			qdel(tempbans)
+			return FALSE
+
+		while(tempbans.NextRow())
+			var/ckey = tempbans.item[1]
+			var/job = tempbans.item[2]
+			GLOB.jobban_keylist.Add("[ckey] - [job]")
+			jobban_assoc_insert(ckey, job)
+
+		qdel(tempbans)
+
 /proc/jobban_savebanfile()
 	var/savefile/S=new("data/job_full.ban")
 	S["keys[0]"] << GLOB.jobban_keylist
@@ -134,8 +142,16 @@ GLOBAL_DATUM_INIT(jobban_regex, /regex, regex("(\[\\S]+) - (\[^#]+\[^# ])(?: ##
 	else
 		//using the SQL ban system
 		var/is_actually_banned = FALSE
-		var/DBQuery/select_query = GLOB.dbcon.NewQuery("SELECT bantime, bantype, reason, job, duration, expiration_time, a_ckey FROM [format_table_name("ban")] WHERE ckey like '[ckey]' AND ((bantype like 'JOB_TEMPBAN' AND expiration_time > Now()) OR (bantype like 'JOB_PERMABAN')) AND isnull(unbanned) ORDER BY bantime DESC LIMIT 100")
-		select_query.Execute()
+		var/datum/db_query/select_query = SSdbcore.NewQuery({"
+			SELECT bantime, bantype, reason, job, duration, expiration_time, a_ckey FROM [format_table_name("ban")]
+			WHERE ckey LIKE :ckey AND ((bantype like 'JOB_TEMPBAN' AND expiration_time > Now()) OR (bantype like 'JOB_PERMABAN')) AND isnull(unbanned)
+			ORDER BY bantime DESC LIMIT 100"},
+			list("ckey" = ckey)
+		)
+
+		if(!select_query.warn_execute())
+			qdel(select_query)
+			return FALSE
 
 		while(select_query.NextRow())
 
@@ -154,6 +170,8 @@ GLOBAL_DATUM_INIT(jobban_regex, /regex, regex("(\[\\S]+) - (\[^#]+\[^# ])(?: ##
 
 			is_actually_banned = TRUE
 
+		qdel(select_query)
+
 		if(is_actually_banned)
 			if(config.banappeals)
 				to_chat(src, "<span class='warning'>You can appeal the bans at: [config.banappeals]</span>")

code/modules/admin/create_poll.dm

@@ -1,202 +0,0 @@
-/client/proc/create_poll()
-	set name = "Create Server Poll"
-	set category = "Server"
-	if(!check_rights(R_SERVER))
-		return
-	if(!GLOB.dbcon.IsConnected())
-		to_chat(src, "<span class='danger'>Failed to establish database connection.</span>")
-		return
-	create_poll_window()
-
-/client/proc/create_poll_window(var/errormessage = "")
-	if(!check_rights(R_SERVER))
-		return
-	var/output={"<!DOCTYPE html>
-<html>
-<head>
-<script>
-var numoptions = 0;
-function update_vis() {
-	var polloptions = document.getElementById("polloptions");
-	var polltype = document.getElementById("polltype").value;
-	if(polltype == "[POLLTYPE_TEXT]") {
-		polloptions.style.display = "none";
-	} else {
-		polloptions.style.display = "block";
-	}
-	if(polltype == "[POLLTYPE_RATING]") {
-		for(var i = 0; i < numoptions; i++) {
-			document.getElementById("ratingoption" + i).style.display = "block";
-		}
-	} else {
-		for(var i = 0; i < numoptions; i++) {
-			document.getElementById("ratingoption" + i).style.display = "none";
-		}
-	}
-	if(polltype == "[POLLTYPE_MULTI]") {
-		document.getElementById("choiceamount").style.display = "block";
-	} else {
-		document.getElementById("choiceamount").style.display = "none";
-	}
-}
-function add_option() {
-	document.getElementById("polloptionsinner").innerHTML += "<div id='polloption"+numoptions+"' style='border:1px solid black;padding:10px'>"+
-	"Option name: <input type='text' name='createpolloption"+numoptions+"option' value='' style='width:300px'></input><br>"+
-	"<label><input type='checkbox' name='createpolloption"+numoptions+"percentagecalc' value='1' checked>Calculate options results as percentage?</label><br>"+
-	"<div id='ratingoption"+numoptions+"'>"+
-	"Minimum rating value: <input type='text' name='createpolloption"+numoptions+"minval' value='1'></input><br>"+
-	"Maximum rating value: <input type='text' name='createpolloption"+numoptions+"maxval' value='5'></input><br>"+
-	"Minimum rating description: <input type='text' name='createpolloption"+numoptions+"descmin' value='Terrible'></input><br>"+
-	"Median rating description: <input type='text' name='createpolloption"+numoptions+"descmid' value=''></input><br>"+
-	"Maximum rating description: <input type='text' name='createpolloption"+numoptions+"descmax' value='Great'></input>"+
-	"</div>";
-	numoptions++;
-	document.getElementById("createpollnumoptions").value = numoptions+"";
-	update_vis();
-}
-function del_option() {
-	if(numoptions <= 1) {
-		return;
-	}
-	numoptions--;
-	document.getElementById("polloptionsinner").removeChild(document.getElementById("polloption"+numoptions));
-	document.getElementById("createpollnumoptions").value = numoptions+"";
-	update_vis();
-}
-function onload() {
-	update_vis();
-	add_option();
-}
-</script>
-</head>
-<body onload="onload()">
-	<div style='text-align:center'><b>Create Player Poll</b></div><hr>
-	<div style='text-align:center'>[errormessage]</div>
-	<form name='createpoll' action='byond://' method='post' style='padding-left:30px;padding-right:30px;padding-top:10px'>
-		<input type='hidden' name='createpollnumoptions' id='createpollnumoptions' value='0'>
-		<table><tr><td style='width:50%' style="vertical-align:top"><div id='polloptions'><div id='polloptionsinner'>
-
-		</div>
-		<input type='button' onclick='add_option()' value="Add Option"></input>
-		<input type='button' onclick='del_option()' value="Delete Option"></input>
-		</div></td><td style="vertical-align:top">
-		Select a poll type: <select name='createpoll' id='polltype' onchange="update_vis()">
-			<option value='[POLLTYPE_OPTION]'>POLLTYPE_OPTION</option>
-			<option value='[POLLTYPE_TEXT]'>POLLTYPE_TEXT</option>
-			<option value='[POLLTYPE_RATING]'>POLLTYPE_RATING</option>
-			<option value='[POLLTYPE_MULTI]'>POLLTYPE_MULTI</option>
-		</select><br>
-		For how many days should this poll run? <input type='text' name='createpollduration' value='7' style='width:50px'></input><br>
-		Enter your question: <input type='text' name='createpollquestion' value='' style='width:300px'></input><br>
-		<div id='choiceamount'>Up to how many options should be chosen? <input name='choiceamount' value='2' style='width:30px'></div>
-		<label><input type='checkbox' name='createpolladminonly' value='1'>Admin only?</label><br>
-		</td></tr><tr><td colspan=2 style='text-align:center'>
-		<input type='submit' value='Create poll'>
-		</td></tr></table>
-	</form>
-</body>
-</html>"}
-	src << browse(output, "window=createplayerpoll;size=950x500")
-
-/client/proc/create_poll_function(href_list)
-	if(!check_rights(R_SERVER))
-		return
-	var/polltype = href_list["createpoll"]
-	if(polltype != POLLTYPE_OPTION && polltype != POLLTYPE_TEXT && polltype != POLLTYPE_RATING && polltype != POLLTYPE_MULTI)
-		create_poll_window("<font color='red'>Invalid poll type</font>")
-		return
-	var/choice_amount = 0
-	if(polltype == POLLTYPE_MULTI)
-		choice_amount = text2num(href_list["choiceamount"])
-		if(!isnum(choice_amount) || choice_amount < 1)
-			create_poll_window("<font color='red'>Invalid choice amount. Must be at least 1.</font>")
-			return
-	var/poll_len = text2num(href_list["createpollduration"])
-	if(!isnum(poll_len) || poll_len < 1)
-		create_poll_window("<font color='red'>Invalid poll duration. Must be at least 1.</font>")
-		return
-	var/adminonly = text2num(href_list["createpolladminonly"]) ? 1 : 0
-	var/sql_ckey = sanitizeSQL(ckey)
-	var/question = href_list["createpollquestion"]
-	if(!question)
-		create_poll_window("<font color='red'>Question cannot be blank.</font>")
-		return
-	question = sanitizeSQL(question)
-
-	var/starttime
-	var/endtime
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT Now() AS starttime, ADDDATE(Now(), INTERVAL [poll_len] DAY) AS endtime")
-	query.Execute()
-	while(query.NextRow())
-		starttime = query.item[1]
-		endtime = query.item[2]
-
-	var/pollquery = "INSERT INTO [format_table_name("poll_question")] (polltype, starttime, endtime, question, adminonly, multiplechoiceoptions, createdby_ckey, createdby_ip) VALUES ('[polltype]', '[starttime]', '[endtime]', '[question]', '[adminonly]', '[choice_amount]', '[sql_ckey]', '[address]')"
-	var/idquery = "SELECT id FROM [format_table_name("poll_question")] WHERE question = '[question]' AND starttime = '[starttime]' AND endtime = '[endtime]' AND createdby_ckey = '[sql_ckey]' AND createdby_ip = '[address]'"
-	var/list/option_queries = list()
-	if(polltype == POLLTYPE_MULTI || polltype == POLLTYPE_RATING || polltype == POLLTYPE_OPTION)
-		var/numoptions = text2num(href_list["createpollnumoptions"])
-		if(!numoptions)
-			create_poll_window("<font color='red'>Invalid number of options</font>")
-			return
-		for(var/I in 1 to numoptions)
-			var/option = href_list["createpolloption[I]option"]
-			if(!option)
-				create_poll_window("<font color='red'>Invalid option name for option [I]</font>")
-				return
-			option = sanitizeSQL(option)
-			var/percentagecalc = 0
-			if(text2num(href_list["createpolloption[I]percentagecalc"]))
-				percentagecalc = 1
-			var/minval = 0
-			var/maxval = 0
-			var/descmin = ""
-			var/descmid = ""
-			var/descmax = ""
-			if(polltype == POLLTYPE_RATING)
-				minval = text2num(href_list["createpolloption[I]minval"])
-				if(!minval)
-					create_poll_window("<font color='red'>Invalid minimum value for option [I]</font>")
-					return
-				maxval = text2num(href_list["createpolloption[I]maxval"])
-				if(!maxval)
-					create_poll_window("<font color='red'>Invalid maximum value for option [I]</font>")
-					return
-				if(minval >= maxval)
-					create_poll_window("<font color='red'>Minimum rating value can't be more than maximum rating value</font>")
-					return
-				descmin = href_list["createpolloption[I]descmin"]
-				if(descmin)
-					descmin = sanitizeSQL(descmin)
-				descmid = href_list["createpolloption[I]descmid"]
-				if(descmid)
-					descmid = sanitizeSQL(descmid)
-				descmax = href_list["createpolloption[I]descmax"]
-				if(descmax)
-					descmax = sanitizeSQL(descmax)
-			option_queries += "INSERT INTO [format_table_name("poll_option")] (pollid, text, percentagecalc, minval, maxval, descmin, descmid, descmax) VALUES ('{POLLID}', '[option]', '[percentagecalc]', '[minval]', '[maxval]', '[descmin]', '[descmid]', '[descmax]')"
-
-	query = GLOB.dbcon.NewQuery(pollquery)
-	if(!query.Execute())
-		var/err = query.ErrorMsg()
-		create_poll_window("<font color='red'>An SQL error has occured while creating your poll</font>")
-		log_game("SQL ERROR adding new poll question to table. Error : \[[err]\]\n")
-		return
-	var/pollid = 0
-	query = GLOB.dbcon.NewQuery(idquery)
-	if(!query.Execute())
-		var/err = query.ErrorMsg()
-		create_poll_window("<font color='red'>An SQL error has occured while creating your poll</font>")
-		log_game("SQL ERROR obtaining id from poll_question table. Error : \[[err]\]\n")
-		return
-	if(query.NextRow())
-		pollid = text2num(query.item[1])
-	for(var/querytext in option_queries)
-		query = GLOB.dbcon.NewQuery(replacetext(idquery, "{POLLID}", pollid))
-		if(!query.Execute())
-			var/err = query.ErrorMsg()
-			create_poll_window("<font color='red'>An SQL error has occured while creating your poll</font>")
-			log_game("SQL ERROR obtaining id from poll_question table. Error : \[[err]\]\n")
-			return
-	create_poll_window("<font color='#008800'>Your poll has been successfully created</font>")
-	return pollid

code/modules/admin/db_ban/functions.dm

@@ -4,8 +4,8 @@
 
 	if(!check_rights(R_BAN))	return
 
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
+		to_chat(usr, "<span class='boldannounce'>Database connection failure when attempting to make DB ban. Please freeze them and write their ckey in notepad, so they can be banned when the DB returns.</span>")
 		return
 
 	var/serverip = "[world.internet_address]:[world.port]"
@@ -86,16 +86,22 @@
 		message_admins("<font color='red'>[key_name_admin(usr)] attempted to add a ban based on a non-existent mob, with no ckey provided. Report this bug.",1)
 		return
 
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT id FROM [format_table_name("player")] WHERE ckey = '[ckey]'")
-	query.Execute()
-	var/validckey = 0
+	var/datum/db_query/query = SSdbcore.NewQuery("SELECT id FROM [format_table_name("player")] WHERE ckey=:ckey", list(
+		"ckey" = ckey
+	))
+	if(!query.warn_execute())
+		qdel(query)
+		return
+	var/validckey = FALSE
 	if(query.NextRow())
-		validckey = 1
+		validckey = TRUE
 	if(!validckey)
 		if(!banned_mob || (banned_mob && !IsGuestKey(banned_mob.key)))
 			message_admins("<font color='red'>[key_name_admin(usr)] attempted to ban [ckey], but [ckey] does not exist in the player database. Please only ban actual players.</font>",1)
+			qdel(query)
 			return
 
+	qdel(query)
 	var/a_ckey
 	var/a_computerid
 	var/a_ip
@@ -124,25 +130,51 @@
 		else
 			adminwho += ", [C]"
 
-	reason = sanitizeSQL(reason)
-
 	if(maxadminbancheck)
-		var/DBQuery/adm_query = GLOB.dbcon.NewQuery("SELECT count(id) AS num FROM [format_table_name("ban")] WHERE (a_ckey = '[a_ckey]') AND (bantype = 'ADMIN_PERMABAN'  OR (bantype = 'ADMIN_TEMPBAN' AND expiration_time > Now())) AND isnull(unbanned)")
-		adm_query.Execute()
+		var/datum/db_query/adm_query = SSdbcore.NewQuery("SELECT count(id) AS num FROM [format_table_name("ban")] WHERE (a_ckey=:a_ckey) AND (bantype = 'ADMIN_PERMABAN'  OR (bantype = 'ADMIN_TEMPBAN' AND expiration_time > Now())) AND isnull(unbanned)", list(
+			"a_ckey" = a_ckey
+		))
+		if(!adm_query.warn_execute())
+			qdel(adm_query)
+			return
 		if(adm_query.NextRow())
 			var/adm_bans = text2num(adm_query.item[1])
 			if(adm_bans >= MAX_ADMIN_BANS_PER_ADMIN)
 				to_chat(usr, "<span class='danger'>You already logged [MAX_ADMIN_BANS_PER_ADMIN] admin ban(s) or more. Do not abuse this function!</span>")
+				qdel(adm_query)
 				return
+		qdel(adm_query)
 
-	var/sql = "INSERT INTO [format_table_name("ban")] (`id`,`bantime`,`serverip`,`bantype`,`reason`,`job`,`duration`,`rounds`,`expiration_time`,`ckey`,`computerid`,`ip`,`a_ckey`,`a_computerid`,`a_ip`,`who`,`adminwho`,`edits`,`unbanned`,`unbanned_datetime`,`unbanned_ckey`,`unbanned_computerid`,`unbanned_ip`) VALUES (null, Now(), '[serverip]', '[bantype_str]', '[reason]', '[job]', [(duration)?"[duration]":"0"], [(rounds)?"[rounds]":"0"], Now() + INTERVAL [(duration>0) ? duration : 0] MINUTE, '[ckey]', '[computerid]', '[ip]', '[a_ckey]', '[a_computerid]', '[a_ip]', '[who]', '[adminwho]', '', null, null, null, null, null)"
-	var/DBQuery/query_insert = GLOB.dbcon.NewQuery(sql)
-	query_insert.Execute()
+	var/datum/db_query/query_insert = SSdbcore.NewQuery({"
+		INSERT INTO [format_table_name("ban")] (`id`,`bantime`,`serverip`,`bantype`,`reason`,`job`,`duration`,`rounds`,`expiration_time`,`ckey`,`computerid`,`ip`,`a_ckey`,`a_computerid`,`a_ip`,`who`,`adminwho`,`edits`,`unbanned`,`unbanned_datetime`,`unbanned_ckey`,`unbanned_computerid`,`unbanned_ip`)
+		VALUES (null, Now(), :serverip, :bantype_str, :reason, :job, :duration, :rounds, Now() + INTERVAL :duration MINUTE, :ckey, :computerid, :ip, :a_ckey, :a_computerid, :a_ip, :who, :adminwho, '', null, null, null, null, null)
+	"}, list(
+		// Get ready for parameters
+		"serverip" = serverip,
+		"bantype_str" = bantype_str,
+		"reason" = reason,
+		"job" = job,
+		"duration" = (duration ? "[duration]" : "0"), // Strings are important here
+		"rounds" = (rounds ? "[rounds]" : "0"), // And here
+		"ckey" = ckey,
+		"computerid" = computerid,
+		"ip" = ip,
+		"a_ckey" = a_ckey,
+		"a_computerid" = a_computerid,
+		"a_ip" = a_ip,
+		"who" = who,
+		"adminwho" = adminwho
+	))
+	if(!query_insert.warn_execute())
+		qdel(query_insert)
+		return
+
+	qdel(query_insert)
 	to_chat(usr, "<span class='notice'>Ban saved to database.</span>")
 	message_admins("[key_name_admin(usr)] has added a [bantype_str] for [ckey] [(job)?"([job])":""] [(duration > 0)?"([duration] minutes)":""] with the reason: \"[reason]\" to the ban database.",1)
 
 	if(announce_in_discord)
-		SSdiscord.send2discord_simple(DISCORD_WEBHOOK_ADMIN, "**BAN ALERT** [a_ckey] applied a [bantype_str] on [ckey]")
+		SSdiscord.send2discord_simple(DISCORD_WEBHOOK_ADMIN, "**\[Ban]** [a_ckey] applied a [bantype_str] on [ckey]")
 
 	if(kickbannedckey)
 		if(banned_mob && banned_mob.client && banned_mob.client.ckey == banckey)
@@ -157,6 +189,10 @@
 
 	if(!check_rights(R_BAN))	return
 
+	if(!SSdbcore.IsConnected())
+		to_chat(usr, "<span class='boldannounce'>Database connection failure when attempting to remove DB ban. Please remember to unban them at a later date!.</span>")
+		return
+
 	var/bantype_str
 	var/isjobban // For job bans, which need to be removed from the job ban lists
 	if(bantype)
@@ -196,23 +232,28 @@
 	else
 		bantype_sql = "bantype = '[bantype_str]'"
 
-	var/sql = "SELECT id FROM [format_table_name("ban")] WHERE ckey = '[ckey]' AND [bantype_sql] AND (unbanned is null OR unbanned = false)"
+	var/sql = "SELECT id FROM [format_table_name("ban")] WHERE ckey=:ckey AND [bantype_sql] AND (unbanned is null OR unbanned = false)"
+	var/list/sql_params = list(
+		"ckey" = ckey
+	)
 	if(job)
-		sql += " AND job = '[job]'"
-
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
-		return
+		sql += " AND job=:job"
+		sql_params["job"] = job
 
 	var/ban_id
 	var/ban_number = 0 //failsafe
 
-	var/DBQuery/query = GLOB.dbcon.NewQuery(sql)
-	query.Execute()
+	var/datum/db_query/query = SSdbcore.NewQuery(sql, sql_params)
+	if(!query.warn_execute())
+		qdel(query)
+		return
+
 	while(query.NextRow())
 		ban_id = query.item[1]
 		ban_number++
 
+	qdel(query)
+
 	if(ban_number == 0)
 		to_chat(usr, "<span class='warning'>Database update failed due to no bans fitting the search criteria. If this is not a legacy ban you should contact the database admin.</span>")
 		return
@@ -241,8 +282,12 @@
 		to_chat(usr, "Cancelled")
 		return
 
-	var/DBQuery/query = GLOB.dbcon.NewQuery("SELECT ckey, duration, reason, job FROM [format_table_name("ban")] WHERE id = [banid]")
-	query.Execute()
+	var/datum/db_query/query = SSdbcore.NewQuery("SELECT ckey, duration, reason, job FROM [format_table_name("ban")] WHERE id=:banid", list(
+		"banid" = banid
+	))
+	if(!query.warn_execute())
+		qdel(query)
+		return
 
 	var/eckey = usr.ckey	//Editing admin ckey
 	var/pckey				//(banned) Player ckey
@@ -257,22 +302,31 @@
 		job = query.item[4]
 	else
 		to_chat(usr, "Invalid ban id. Contact the database admin")
+		qdel(query)
 		return
 
-	reason = sanitizeSQL(reason)
+	qdel(query)
 	var/value
 
 	switch(param)
 		if("reason")
 			if(!value)
 				value = input("Insert the new reason for [pckey]'s ban", "New Reason", "[reason]", null) as null|text
-				value = sanitizeSQL(value)
 				if(!value)
 					to_chat(usr, "Cancelled")
 					return
 
-			var/DBQuery/update_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("ban")] SET reason = '[value]', edits = CONCAT(edits,'- [eckey] changed ban reason from <cite><b>\\\"[reason]\\\"</b></cite> to <cite><b>\\\"[value]\\\"</b></cite><BR>') WHERE id = [banid]")
-			update_query.Execute()
+			var/edit_reason = "- [eckey] changed ban reason from <cite><b>\\\"[reason]\\\"</b></cite> to <cite><b>\\\"[value]\\\"</b></cite><BR>"
+			var/datum/db_query/update_query = SSdbcore.NewQuery("UPDATE [format_table_name("ban")] SET reason=:value, edits = CONCAT(IFNULL(edits,''), :edittext) WHERE id=:banid", list(
+				"edittext" = edit_reason,
+				"banid" = banid,
+				"value" = value
+			))
+
+			if(!update_query.warn_execute())
+				qdel(update_query)
+				return
+			qdel(update_query)
 			message_admins("[key_name_admin(usr)] has edited a ban for [pckey]'s reason from [reason] to [value]",1)
 		if("duration")
 			if(!value)
@@ -281,9 +335,18 @@
 					to_chat(usr, "Cancelled")
 					return
 
-			var/DBQuery/update_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("ban")] SET duration = [value], edits = CONCAT(edits,'- [eckey] changed ban duration from [duration] to [value]<br>'), expiration_time = DATE_ADD(bantime, INTERVAL [value] MINUTE) WHERE id = [banid]")
+			var/edittext = "- [eckey] changed ban duration from [duration] to [value]<br>"
+			var/datum/db_query/update_query = SSdbcore.NewQuery("UPDATE [format_table_name("ban")] SET duration=:value, edits = CONCAT(IFNULL(edits, ''), :edittext), expiration_time = DATE_ADD(bantime, INTERVAL :value MINUTE) WHERE id=:banid", list(
+				"edittext" = edittext,
+				"banid" = banid,
+				"value" = value
+			))
+			if(!update_query.warn_execute())
+				qdel(update_query)
+				return
+
+			qdel(update_query)
 			message_admins("[key_name_admin(usr)] has edited a ban for [pckey]'s duration from [duration] to [value]",1)
-			update_query.Execute()
 		if("unban")
 			if(alert("Unban [pckey]?", "Unban?", "Yes", "No") == "Yes")
 				DB_ban_unban_by_id(banid)
@@ -302,21 +365,25 @@
 	if(!check_rights(R_BAN))
 		return
 
-	var/sql = "SELECT ckey FROM [format_table_name("ban")] WHERE id = [id]"
-
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
+		to_chat(usr, "<span class='boldannounce'>Database connection failure when attempting to remove DB ban. Please remember to unban them at a later date!.</span>")
 		return
 
 	var/ban_number = 0 //failsafe
 
 	var/pckey
-	var/DBQuery/query = GLOB.dbcon.NewQuery(sql)
-	query.Execute()
+	var/datum/db_query/query = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("ban")] WHERE id=:banid", list(
+		"banid" = id
+	))
+	if(!query.warn_execute())
+		qdel(query)
+		return
 	while(query.NextRow())
 		pckey = query.item[1]
 		ban_number++
 
+	qdel(query)
+
 	if(ban_number == 0)
 		to_chat(usr, "<span class='warning'>Database update failed due to a ban id not being present in the database.</span>")
 		return
@@ -332,12 +399,19 @@
 	var/unban_computerid = src.owner:computer_id
 	var/unban_ip = src.owner:address
 
-	var/sql_update = "UPDATE [format_table_name("ban")] SET unbanned = 1, unbanned_datetime = Now(), unbanned_ckey = '[unban_ckey]', unbanned_computerid = '[unban_computerid]', unbanned_ip = '[unban_ip]' WHERE id = [id]"
-	message_admins("[key_name_admin(usr)] has lifted [pckey]'s ban.",1)
+	var/datum/db_query/query_update = SSdbcore.NewQuery("UPDATE [format_table_name("ban")] SET unbanned = 1, unbanned_datetime = Now(), unbanned_ckey=:unban_ckey, unbanned_computerid=:unban_computerid, unbanned_ip=:unban_ip WHERE id=:id", list(
+		"unban_ckey" = unban_ckey,
+		"unban_computerid" = unban_computerid,
+		"unban_ip" = unban_ip,
+		"id" = id
+	))
+	if(!query_update.warn_execute())
+		qdel(query_update)
+		return
 
-	var/DBQuery/query_update = GLOB.dbcon.NewQuery(sql_update)
-	query_update.Execute()
+	qdel(query_update)
 
+	message_admins("[key_name_admin(usr)] has lifted [pckey]'s ban.")
 	flag_account_for_forum_sync(pckey)
 
 
@@ -360,8 +434,7 @@
 	if(!check_rights(R_BAN))
 		return
 
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		to_chat(usr, "<span class='warning'>Failed to establish database connection</span>")
 		return
 
@@ -436,8 +509,6 @@
 
 		adminckey = ckey(adminckey)
 		playerckey = ckey(playerckey)
-		playerip = sanitizeSQL(playerip)
-		playercid = sanitizeSQL(playercid)
 
 		if(adminckey || playerckey || playerip || playercid || dbbantype)
 
@@ -461,24 +532,34 @@
 			var/cidsearch = ""
 			var/bantypesearch = ""
 
+			var/list/sql_params = list()
+
 			if(!match)
 				if(adminckey)
-					adminsearch = "AND a_ckey = '[adminckey]' "
+					adminsearch = "AND a_ckey=:adminckey "
+					sql_params["adminckey"] = adminckey
 				if(playerckey)
-					playersearch = "AND ckey = '[playerckey]' "
+					playersearch = "AND ckey=:playerckey "
+					sql_params["playerckey"] = playerckey
 				if(playerip)
-					ipsearch  = "AND ip = '[playerip]' "
+					ipsearch  = "AND ip=:playerip "
+					sql_params["playerip"] = playerip
 				if(playercid)
-					cidsearch  = "AND computerid = '[playercid]' "
+					cidsearch  = "AND computerid=:playercid "
+					sql_params["playercid"] = playercid
 			else
 				if(adminckey && length(adminckey) >= 3)
-					adminsearch = "AND a_ckey LIKE '[adminckey]%' "
+					adminsearch = "AND a_ckey LIKE :adminckey "
+					sql_params["adminckey"] = "[adminckey]%"
 				if(playerckey && length(playerckey) >= 3)
-					playersearch = "AND ckey LIKE '[playerckey]%' "
+					playersearch = "AND ckey LIKE :playerckey "
+					sql_params["playerckey"] = "[playerckey]%"
 				if(playerip && length(playerip) >= 3)
-					ipsearch  = "AND ip LIKE '[playerip]%' "
+					ipsearch  = "AND ip LIKE :playerip "
+					sql_params["playerip"] = "[playerip]%"
 				if(playercid && length(playercid) >= 7)
-					cidsearch  = "AND computerid LIKE '[playercid]%' "
+					cidsearch  = "AND computerid LIKE :playercid "
+					sql_params["playercid"] = "[playercid]%"
 
 			if(dbbantype)
 				bantypesearch = "AND bantype = "
@@ -500,8 +581,13 @@
 						bantypesearch += "'PERMABAN' "
 
 
-			var/DBQuery/select_query = GLOB.dbcon.NewQuery("SELECT id, bantime, bantype, reason, job, duration, expiration_time, ckey, a_ckey, unbanned, unbanned_ckey, unbanned_datetime, edits, ip, computerid FROM [format_table_name("ban")] WHERE 1 [playersearch] [adminsearch] [ipsearch] [cidsearch] [bantypesearch] ORDER BY bantime DESC LIMIT 100")
-			select_query.Execute()
+			var/datum/db_query/select_query = SSdbcore.NewQuery({"
+				SELECT id, bantime, bantype, reason, job, duration, expiration_time, ckey, a_ckey, unbanned, unbanned_ckey, unbanned_datetime, edits, ip, computerid
+				FROM [format_table_name("ban")] WHERE 1 [playersearch] [adminsearch] [ipsearch] [cidsearch] [bantypesearch] ORDER BY bantime DESC LIMIT 100"}, sql_params)
+
+			if(!select_query.warn_execute())
+				qdel(select_query)
+				return
 
 			while(select_query.NextRow())
 				var/banid = select_query.item[1]
@@ -552,7 +638,7 @@
 				output += "</tr>"
 				output += "<tr bgcolor='[dcolor]'>"
 				output += "<td align='center' colspan='2' bgcolor=''><b>IP:</b> [ip]</td>"
-				output += "<td align='center' colspan='3' bgcolor=''><b>CIP:</b> [cid]</td>"
+				output += "<td align='center' colspan='3' bgcolor=''><b>CID:</b> [cid]</td>"
 				output += "</tr>"
 				output += "<tr bgcolor='[lcolor]'>"
 				output += "<td align='center' colspan='5'><b>Reason: [(unbanned) ? "" : "(<a href=\"byond://?src=[UID()];dbbanedit=reason;dbbanid=[banid]\">Edit</a>)"]</b> <cite>\"[reason]\"</cite></td>"
@@ -574,12 +660,17 @@
 
 			output += "</table></div>"
 
+			qdel(select_query)
+
 	usr << browse(output,"window=lookupbans;size=900x700")
 
 /proc/flag_account_for_forum_sync(ckey)
-	if(!GLOB.dbcon)
+	if(!SSdbcore.IsConnected())
 		return
-	var/skey = sanitizeSQL(ckey)
-	var/sql = "UPDATE [format_table_name("player")] SET fupdate = 1 WHERE ckey = '[skey]'"
-	var/DBQuery/adm_query = GLOB.dbcon.NewQuery(sql)
-	adm_query.Execute()
+	var/datum/db_query/adm_query = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET fupdate = 1 WHERE ckey=:ckey", list(
+		"ckey" = ckey
+	))
+	// We do nothing with output here so we dont need to wrap the warn_execute() inside an if statement
+	adm_query.warn_execute()
+	qdel(adm_query)
+

code/modules/admin/ipintel.dm

@@ -23,7 +23,6 @@
 
 /proc/get_ip_intel(ip, bypasscache = FALSE, updatecache = TRUE)
 	var/datum/ipintel/res = new()
-	ip = sanitizeSQL(ip)
 	res.ip = ip
 	. = res
 	if(!ip || !config.ipintel_email || !SSipintel.enabled)
@@ -34,24 +33,28 @@
 			cachedintel.cache = TRUE
 			return cachedintel
 
-		if(GLOB.dbcon.IsConnected())
-			var/rating_bad = config.ipintel_rating_bad
-			var/DBQuery/query_get_ip_intel = GLOB.dbcon.NewQuery({"
+		if(SSdbcore.IsConnected())
+			var/datum/db_query/query_get_ip_intel = SSdbcore.NewQuery({"
 				SELECT date, intel, TIMESTAMPDIFF(MINUTE,date,NOW())
 				FROM [format_table_name("ipintel")]
 				WHERE
-					ip = INET_ATON('[ip]')
+					ip = INET_ATON(:ip)
 					AND ((
-							intel < [rating_bad]
+							intel < :rating_bad
 							AND
-							date + INTERVAL [config.ipintel_save_good] HOUR > NOW()
+							date + INTERVAL :save_good HOUR > NOW()
 						) OR (
-							intel >= [rating_bad]
+							intel >= :rating_bad
 							AND
-							date + INTERVAL [config.ipintel_save_bad] HOUR > NOW()
+							date + INTERVAL :save_bad HOUR > NOW()
 					))
-				"})
-			if(!query_get_ip_intel.Execute())
+				"}, list(
+					"ip" = ip,
+					"rating_bad" = config.ipintel_rating_bad,
+					"save_good" = config.ipintel_save_good,
+					"save_bad" = config.ipintel_save_bad,
+				))
+			if(!query_get_ip_intel.warn_execute())
 				qdel(query_get_ip_intel)
 				return
 			if(query_get_ip_intel.NextRow())
@@ -67,9 +70,16 @@
 	res.intel = ip_intel_query(ip)
 	if(updatecache && res.intel >= 0)
 		SSipintel.cache[ip] = res
-		if(GLOB.dbcon.IsConnected())
-			var/DBQuery/query_add_ip_intel = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("ipintel")] (ip, intel) VALUES (INET_ATON('[ip]'), [res.intel]) ON DUPLICATE KEY UPDATE intel = VALUES(intel), date = NOW()")
-			query_add_ip_intel.Execute()
+		if(SSdbcore.IsConnected())
+			var/datum/db_query/query_add_ip_intel = SSdbcore.NewQuery({"
+				INSERT INTO [format_table_name("ipintel")] (ip, intel) VALUES (INET_ATON(:ip), :intel)
+				ON DUPLICATE KEY UPDATE intel = VALUES(intel), date = NOW()"},
+				list(
+					"ip" = ip,
+					"intel" = res.intel
+				)
+			)
+			query_add_ip_intel.warn_execute()
 			qdel(query_add_ip_intel)
 
 
@@ -140,7 +150,7 @@
 		return FALSE
 	if(!config.ipintel_whitelist)
 		return FALSE
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		return FALSE
 	if(!ipintel_badip_check(t_ip))
 		return FALSE
@@ -157,12 +167,16 @@
 	if(!valid_hours)
 		log_debug("ipintel_badip_check reports misconfigured ipintel_save_bad directive")
 		return FALSE
-	target_ip = sanitizeSQL(target_ip)
-	rating_bad = sanitizeSQL(rating_bad)
-	valid_hours = sanitizeSQL(valid_hours)
-	var/check_sql = {"SELECT * FROM [format_table_name("ipintel")] WHERE ip = INET_ATON('[target_ip]') AND intel >= [rating_bad] AND (date + INTERVAL [valid_hours] HOUR) > NOW()"}
-	var/DBQuery/query_get_ip_intel = GLOB.dbcon.NewQuery(check_sql)
-	if(!query_get_ip_intel.Execute())
+	var/datum/db_query/query_get_ip_intel = SSdbcore.NewQuery({"
+		SELECT * FROM [format_table_name("ipintel")] WHERE ip = INET_ATON(:target_ip)
+		AND intel >= :rating_bad AND (date + INTERVAL :valid_hours HOUR) > NOW()"},
+		list(
+			"target_ip" = target_ip,
+			"rating_bad" = rating_bad,
+			"valid_hours" = valid_hours
+		)
+	)
+	if(!query_get_ip_intel.warn_execute())
 		log_debug("ipintel_badip_check reports failed query execution")
 		qdel(query_get_ip_intel)
 		return FALSE
@@ -175,36 +189,40 @@
 /proc/vpn_whitelist_check(target_ckey)
 	if(!config.ipintel_whitelist)
 		return FALSE
-	var/target_sql_ckey = ckey(target_ckey)
-	var/DBQuery/query_whitelist_check = GLOB.dbcon.NewQuery("SELECT * FROM [format_table_name("vpn_whitelist")] WHERE ckey = '[target_sql_ckey]'")
-	if(!query_whitelist_check.Execute())
-		var/err = query_whitelist_check.ErrorMsg()
-		log_debug("SQL ERROR on proc/vpn_whitelist_check for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+	var/datum/db_query/query_whitelist_check = SSdbcore.NewQuery("SELECT * FROM [format_table_name("vpn_whitelist")] WHERE ckey=:ckey", list(
+		"ckey" = target_ckey
+	))
+	if(!query_whitelist_check.warn_execute())
+		qdel(query_whitelist_check)
 		return FALSE
 	if(query_whitelist_check.NextRow())
+		qdel(query_whitelist_check)
 		return TRUE // At least one row in the whitelist names their ckey. That means they are whitelisted.
+	qdel(query_whitelist_check)
 	return FALSE
 
 /proc/vpn_whitelist_add(target_ckey)
-	var/target_sql_ckey = ckey(target_ckey)
 	var/reason_string = input(usr, "Enter link to the URL of their whitelist request on the forum.","Reason required") as message|null
 	if(!reason_string)
 		return FALSE
-	reason_string = sanitizeSQL(reason_string)
-	var/DBQuery/query_whitelist_add = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("vpn_whitelist")] (ckey,reason) VALUES ('[target_sql_ckey]','[reason_string]')")
-	if(!query_whitelist_add.Execute())
-		var/err = query_whitelist_add.ErrorMsg()
-		log_debug("SQL ERROR on proc/vpn_whitelist_add for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+	var/datum/db_query/query_whitelist_add = SSdbcore.NewQuery("INSERT INTO [format_table_name("vpn_whitelist")] (ckey,reason) VALUES (:targetckey, :reason)", list(
+		"targetckey" = target_ckey,
+		"reason" = reason_string
+	))
+	if(!query_whitelist_add.warn_execute())
+		qdel(query_whitelist_add)
 		return FALSE
+	qdel(query_whitelist_add)
 	return TRUE
 
 /proc/vpn_whitelist_remove(target_ckey)
-	var/target_sql_ckey = ckey(target_ckey)
-	var/DBQuery/query_whitelist_remove = GLOB.dbcon.NewQuery("DELETE FROM [format_table_name("vpn_whitelist")] WHERE ckey = '[target_sql_ckey]'")
-	if(!query_whitelist_remove.Execute())
-		var/err = query_whitelist_remove.ErrorMsg()
-		log_debug("SQL ERROR on proc/vpn_whitelist_remove for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+	var/datum/db_query/query_whitelist_remove = SSdbcore.NewQuery("DELETE FROM [format_table_name("vpn_whitelist")] WHERE ckey=:targetckey", list(
+		"targetckey" = target_ckey
+	))
+	if(!query_whitelist_remove.warn_execute())
+		qdel(query_whitelist_remove)
 		return FALSE
+	qdel(query_whitelist_remove)
 	return TRUE
 
 /proc/vpn_whitelist_panel(target_ckey as text)

code/modules/admin/permissionverbs/permissionedit.dm

@@ -60,9 +60,7 @@
 	if(!check_rights(R_PERMISSIONS))
 		return
 
-	establish_db_connection()
-
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		to_chat(usr, "<span class='warning'>Failed to establish database connection</span>")
 		return
 
@@ -77,28 +75,63 @@
 	if(!istext(adm_ckey) || !istext(new_rank))
 		return
 
-	var/DBQuery/select_query = GLOB.dbcon.NewQuery("SELECT id FROM [format_table_name("admin")] WHERE ckey = '[adm_ckey]'")
-	select_query.Execute()
+	var/datum/db_query/select_query = SSdbcore.NewQuery("SELECT id FROM [format_table_name("admin")] WHERE ckey=:adm_ckey", list(
+		"adm_ckey" = adm_ckey
+	))
+	if(!select_query.warn_execute())
+		qdel(select_query)
+		return
 
-	var/new_admin = 1
+	var/new_admin = TRUE
 	var/admin_id
 	while(select_query.NextRow())
-		new_admin = 0
+		new_admin = FALSE
 		admin_id = text2num(select_query.item[1])
-
+	qdel(select_query)
 	flag_account_for_forum_sync(adm_ckey)
 	if(new_admin)
-		var/DBQuery/insert_query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("admin")] (`id`, `ckey`, `rank`, `level`, `flags`) VALUES (null, '[adm_ckey]', '[new_rank]', -1, 0)")
-		insert_query.Execute()
-		var/DBQuery/log_query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , '[usr.ckey]', '[usr.client.address]', 'Added new admin [adm_ckey] to rank [new_rank]');")
-		log_query.Execute()
+		var/datum/db_query/insert_query = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin")] (`id`, `ckey`, `rank`, `level`, `flags`) VALUES (null, :adm_ckey, :new_rank, -1, 0)", list(
+			"adm_ckey" = adm_ckey,
+			"new_rank" = new_rank
+		))
+		if(!insert_query.warn_execute())
+			qdel(insert_query)
+			return
+		qdel(insert_query)
+
+		var/logtxt = "Added new admin [adm_ckey] to rank [new_rank]"
+		var/datum/db_query/log_query = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , :uckey, :uip, :logtxt)", list(
+			"uckey" = usr.ckey,
+			"uip" = usr.client.address,
+			"logtxt" = logtxt
+		))
+		if(!log_query.warn_execute())
+			qdel(log_query)
+			return
+		qdel(log_query)
+
 		to_chat(usr, "<span class='notice'>New admin added.</span>")
 	else
 		if(!isnull(admin_id) && isnum(admin_id))
-			var/DBQuery/insert_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("admin")] SET rank = '[new_rank]' WHERE id = [admin_id]")
-			insert_query.Execute()
-			var/DBQuery/log_query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , '[usr.ckey]', '[usr.client.address]', 'Edited the rank of [adm_ckey] to [new_rank]');")
-			log_query.Execute()
+			var/datum/db_query/insert_query = SSdbcore.NewQuery("UPDATE [format_table_name("admin")] SET rank=:new_rank WHERE id=:admin_id", list(
+				"new_rank" = new_rank,
+				"admin_id" = admin_id,
+			))
+			if(!insert_query.warn_execute())
+				qdel(insert_query)
+				return
+			qdel(insert_query)
+
+			var/logtxt = "Edited the rank of [adm_ckey] to [new_rank]"
+			var/datum/db_query/log_query = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , :uckey, :uip, :logtxt)", list(
+				"uckey" = usr.ckey,
+				"uip" = usr.client.address,
+				"logtxt" = logtxt,
+			))
+			if(!log_query.warn_execute())
+				qdel(log_query)
+				return
+			qdel(log_query)
 			to_chat(usr, "<span class='notice'>Admin rank changed.</span>")
 
 /datum/admins/proc/log_admin_permission_modification(var/adm_ckey, var/new_permission)
@@ -116,8 +149,7 @@
 	if(!check_rights(R_PERMISSIONS))
 		return
 
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		to_chat(usr, "<span class='warning'>Failed to establish database connection</span>")
 		return
 
@@ -135,8 +167,12 @@
 	if(!istext(adm_ckey) || !isnum(new_permission))
 		return
 
-	var/DBQuery/select_query = GLOB.dbcon.NewQuery("SELECT id, flags FROM [format_table_name("admin")] WHERE ckey = '[adm_ckey]'")
-	select_query.Execute()
+	var/datum/db_query/select_query = SSdbcore.NewQuery("SELECT id, flags FROM [format_table_name("admin")] WHERE ckey=:adm_ckey", list(
+		"adm_ckey" = adm_ckey
+	))
+	if(!select_query.warn_execute())
+		qdel(select_query)
+		return
 
 	var/admin_id
 	var/admin_rights
@@ -144,32 +180,72 @@
 		admin_id = text2num(select_query.item[1])
 		admin_rights = text2num(select_query.item[2])
 
+	qdel(select_query)
 	if(!admin_id)
 		return
 
 	flag_account_for_forum_sync(adm_ckey)
 	if(admin_rights & new_permission) //This admin already has this permission, so we are removing it.
-		var/DBQuery/insert_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("admin")] SET flags = [admin_rights & ~new_permission] WHERE id = [admin_id]")
-		insert_query.Execute()
-		var/DBQuery/log_query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , '[usr.ckey]', '[usr.client.address]', 'Removed permission [rights2text(new_permission)] (flag = [new_permission]) to admin [adm_ckey]');")
-		log_query.Execute()
+		var/datum/db_query/insert_query = SSdbcore.NewQuery("UPDATE [format_table_name("admin")] SET flags=:newflags WHERE id=:admin_id", list(
+			"newflags" = (admin_rights & ~new_permission),
+			"admin_id" = admin_id
+		))
+		if(!insert_query.warn_execute())
+			qdel(insert_query)
+			return
+		qdel(insert_query)
+
+		var/logtxt = "Removed permission [rights2text(new_permission)] (flag = [new_permission]) to admin [adm_ckey]"
+		var/datum/db_query/log_query = SSdbcore.NewQuery({"
+			INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log`)
+			VALUES (Now() , :uckey, :uip, :logtxt)"}, list(
+				"uckey" = usr.ckey,
+				"uip" = usr.client.address,
+				"logtxt" = logtxt
+			))
+		if(!log_query.warn_execute())
+			qdel(log_query)
+			return
+		qdel(log_query)
 		to_chat(usr, "<span class='notice'>Permission removed.</span>")
 	else //This admin doesn't have this permission, so we are adding it.
-		var/DBQuery/insert_query = GLOB.dbcon.NewQuery("UPDATE [format_table_name("admin")] SET flags = '[admin_rights | new_permission]' WHERE id = [admin_id]")
-		insert_query.Execute()
-		var/DBQuery/log_query = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log` ) VALUES (Now() , '[usr.ckey]', '[usr.client.address]', 'Added permission [rights2text(new_permission)] (flag = [new_permission]) to admin [adm_ckey]')")
-		log_query.Execute()
+		var/datum/db_query/insert_query = SSdbcore.NewQuery("UPDATE [format_table_name("admin")] SET flags=:newflags WHERE id=:admin_id", list(
+			"newflags" = (admin_rights | new_permission),
+			"admin_id" = admin_id
+		))
+		if(!insert_query.warn_execute())
+			qdel(insert_query)
+			return
+		qdel(insert_query)
+
+		var/logtxt = "Added permission [rights2text(new_permission)] (flag = [new_permission]) to admin [adm_ckey]"
+		var/datum/db_query/log_query = SSdbcore.NewQuery({"
+			INSERT INTO [format_table_name("admin_log")] (`datetime` ,`adminckey` ,`adminip` ,`log`)
+			VALUES (Now() , :uckey, :uip, :logtxt)"}, list(
+				"uckey" = usr.ckey,
+				"uip" = usr.client.address,
+				"logtxt" = logtxt
+			))
+
+		if(!log_query.warn_execute())
+			qdel(log_query)
+			return
+		qdel(log_query)
 		to_chat(usr, "<span class='notice'>Permission added.</span>")
 
 /datum/admins/proc/updateranktodb(ckey,newrank)
-	establish_db_connection()
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		return
 	if(!check_rights(R_PERMISSIONS))
 		return
-	var/sql_ckey = sanitizeSQL(ckey)
-	var/sql_admin_rank = sanitizeSQL(newrank)
 
-	var/DBQuery/query_update = GLOB.dbcon.NewQuery("UPDATE [format_table_name("player")] SET lastadminrank = '[sql_admin_rank]' WHERE ckey = '[sql_ckey]'")
-	query_update.Execute()
-	flag_account_for_forum_sync(sql_ckey)
+	var/datum/db_query/query_update = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET lastadminrank=:admin_rank WHERE ckey=:ckey", list(
+		"admin_rank" = newrank,
+		"ckey" = ckey
+	))
+	if(!query_update.warn_execute())
+		qdel(query_update)
+		return
+
+	qdel(query_update)
+	flag_account_for_forum_sync(ckey)

code/modules/admin/sql_notes.dm

@@ -1,7 +1,8 @@
-/proc/add_note(target_ckey, notetext, timestamp, adminckey, logged = 1, server, checkrights = 1)
+// Do not attemtp to remove the blank string from the server arg. It will break DB saving.
+/proc/add_note(target_ckey, notetext, timestamp, adminckey, logged = 1, server = "", checkrights = 1)
 	if(checkrights && !check_rights(R_ADMIN|R_MOD))
 		return
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		if(usr)
 			to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
 		return
@@ -14,17 +15,27 @@
 	else
 		target_ckey = ckey(target_ckey)
 
-	var/DBQuery/query_find_ckey = GLOB.dbcon.NewQuery("SELECT ckey, exp FROM [format_table_name("player")] WHERE ckey = '[target_ckey]'")
-	if(!query_find_ckey.Execute())
-		var/err = query_find_ckey.ErrorMsg()
-		log_game("SQL ERROR obtaining ckey from player table. Error : \[[err]\]\n")
+	var/datum/db_query/query_find_ckey = SSdbcore.NewQuery("SELECT ckey, exp FROM [format_table_name("player")] WHERE ckey=:ckey", list(
+		"ckey" = target_ckey
+	))
+
+	if(!query_find_ckey.warn_execute())
+		qdel(query_find_ckey)
 		return
-	if(!query_find_ckey.NextRow())
+
+	var/ckey_found = FALSE
+	var/exp_data
+	while(query_find_ckey.NextRow())
+		exp_data = query_find_ckey.item[2]
+		ckey_found = TRUE
+
+	qdel(query_find_ckey)
+
+	if(!ckey_found)
 		if(usr)
 			to_chat(usr, "<span class='redtext'>[target_ckey] has not been seen before, you can only add notes to known players.</span>")
 		return
 
-	var/exp_data = query_find_ckey.item[2]
 	var/crew_number = 0
 	if(exp_data)
 		var/list/play_records = params2list(exp_data)
@@ -34,25 +45,32 @@
 		notetext = input(usr,"Write your note","Add Note") as message|null
 		if(!notetext)
 			return
-	notetext = sanitizeSQL(notetext)
-	if(!timestamp)
-		timestamp = SQLtime()
+
 	if(!adminckey)
 		adminckey = usr.ckey
 		if(!adminckey)
 			return
 	else if(usr && (usr.ckey == ckey(adminckey))) // Don't ckeyize special note sources
 		adminckey = ckey(adminckey)
-	var/admin_sql_ckey = sanitizeSQL(adminckey)
+
 	if(!server)
 		if(config && config.server_name)
 			server = config.server_name
-	server = sanitizeSQL(server)
-	var/DBQuery/query_noteadd = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("notes")] (ckey, timestamp, notetext, adminckey, server, crew_playtime) VALUES ('[target_ckey]', '[timestamp]', '[notetext]', '[admin_sql_ckey]', '[server]', '[crew_number]')")
-	if(!query_noteadd.Execute())
-		var/err = query_noteadd.ErrorMsg()
-		log_game("SQL ERROR adding new note to table. Error : \[[err]\]\n")
+
+	var/datum/db_query/query_noteadd = SSdbcore.NewQuery({"
+		INSERT INTO [format_table_name("notes")] (ckey, timestamp, notetext, adminckey, server, crew_playtime)
+		VALUES (:targetckey, NOW(), :notetext, :adminkey, :server, :crewnum)
+	"}, list(
+		"targetckey" = target_ckey,
+		"notetext" = notetext,
+		"adminkey" = adminckey,
+		"server" = server,
+		"crewnum" = crew_number
+	))
+	if(!query_noteadd.warn_execute())
+		qdel(query_noteadd)
 		return
+	qdel(query_noteadd)
 	if(logged)
 		log_admin("[usr ? key_name(usr) : adminckey] has added a note to [target_ckey]: [notetext]")
 		message_admins("[usr ? key_name_admin(usr) : adminckey] has added a note to [target_ckey]:<br>[notetext]")
@@ -64,27 +82,33 @@
 	var/ckey
 	var/notetext
 	var/adminckey
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		if(usr)
 			to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
 		return
 	if(!note_id)
 		return
 	note_id = text2num(note_id)
-	var/DBQuery/query_find_note_del = GLOB.dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]")
-	if(!query_find_note_del.Execute())
-		var/err = query_find_note_del.ErrorMsg()
-		log_game("SQL ERROR obtaining ckey, notetext, adminckey from player table. Error : \[[err]\]\n")
+	var/datum/db_query/query_find_note_del = SSdbcore.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id=:note_id", list(
+		"note_id" = note_id
+	))
+	if(!query_find_note_del.warn_execute())
+		qdel(query_find_note_del)
 		return
 	if(query_find_note_del.NextRow())
 		ckey = query_find_note_del.item[1]
 		notetext = query_find_note_del.item[2]
 		adminckey = query_find_note_del.item[3]
-	var/DBQuery/query_del_note = GLOB.dbcon.NewQuery("DELETE FROM [format_table_name("notes")] WHERE id = [note_id]")
-	if(!query_del_note.Execute())
-		var/err = query_del_note.ErrorMsg()
-		log_game("SQL ERROR removing note from table. Error : \[[err]\]\n")
+	qdel(query_find_note_del)
+
+	var/datum/db_query/query_del_note = SSdbcore.NewQuery("DELETE FROM [format_table_name("notes")] WHERE id=:note_id", list(
+		"note_id" = note_id
+	))
+	if(!query_del_note.warn_execute())
+		qdel(query_del_note)
 		return
+	qdel(query_del_note)
+
 	log_admin("[usr ? key_name(usr) : "Bot"] has removed a note made by [adminckey] from [ckey]: [notetext]")
 	message_admins("[usr ? key_name_admin(usr) : "Bot"] has removed a note made by [adminckey] from [ckey]:<br>[notetext]")
 	show_note(ckey)
@@ -92,7 +116,7 @@
 /proc/edit_note(note_id)
 	if(!check_rights(R_ADMIN|R_MOD))
 		return
-	if(!GLOB.dbcon.IsConnected())
+	if(!SSdbcore.IsConnected())
 		if(usr)
 			to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
 		return
@@ -100,11 +124,11 @@
 		return
 	note_id = text2num(note_id)
 	var/target_ckey
-	var/sql_ckey = usr.ckey
-	var/DBQuery/query_find_note_edit = GLOB.dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]")
-	if(!query_find_note_edit.Execute())
-		var/err = query_find_note_edit.ErrorMsg()
-		log_game("SQL ERROR obtaining notetext from notes table. Error : \[[err]\]\n")
+	var/datum/db_query/query_find_note_edit = SSdbcore.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id=:note_id", list(
+		"note_id" = note_id
+	))
+	if(!query_find_note_edit.warn_execute())
+		qdel(query_find_note_edit)
 		return
 	if(query_find_note_edit.NextRow())
 		target_ckey = query_find_note_edit.item[1]
@@ -113,17 +137,20 @@
 		var/new_note = input("Input new note", "New Note", "[old_note]") as message|null
 		if(!new_note)
 			return
-		new_note = sanitizeSQL(new_note)
-		var/edit_text = "Edited by [sql_ckey] on [SQLtime()] from \"[old_note]\" to \"[new_note]\"<hr>"
-		edit_text = sanitizeSQL(edit_text)
-		var/DBQuery/query_update_note = GLOB.dbcon.NewQuery("UPDATE [format_table_name("notes")] SET notetext = '[new_note]', last_editor = '[sql_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [note_id]")
-		if(!query_update_note.Execute())
-			var/err = query_update_note.ErrorMsg()
-			log_game("SQL ERROR editing note. Error : \[[err]\]\n")
+		var/edit_text = "Edited by [usr.ckey] on [SQLtime()] from \"[old_note]\" to \"[new_note]\"<hr>"
+		var/datum/db_query/query_update_note = SSdbcore.NewQuery("UPDATE [format_table_name("notes")] SET notetext=:new_note, last_editor=:akey, edits = CONCAT(IFNULL(edits,''),:edit_text) WHERE id=:note_id", list(
+			"new_note" = new_note,
+			"akey" = usr.ckey,
+			"edit_text" = edit_text,
+			"note_id" = note_id
+		))
+		if(!query_update_note.warn_execute())
+			qdel(query_update_note)
 			return
 		log_admin("[usr ? key_name(usr) : "Bot"] has edited [target_ckey]'s note made by [adminckey] from \"[old_note]\" to \"[new_note]\"")
 		message_admins("[usr ? key_name_admin(usr) : "Bot"] has edited [target_ckey]'s note made by [adminckey] from \"[old_note]\" to \"[new_note]\"")
 		show_note(target_ckey)
+		qdel(query_update_note)
 
 /proc/show_note(target_ckey, index, linkless = 0)
 	if(!check_rights(R_ADMIN|R_MOD))
@@ -143,10 +170,13 @@
 		output = navbar
 	if(target_ckey)
 		var/target_sql_ckey = ckey(target_ckey)
-		var/DBQuery/query_get_notes = GLOB.dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server, crew_playtime FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp")
-		if(!query_get_notes.Execute())
-			var/err = query_get_notes.ErrorMsg()
-			log_game("SQL ERROR obtaining ckey, notetext, adminckey, last_editor, server, crew_playtime from notes table. Error : \[[err]\]\n")
+		var/datum/db_query/query_get_notes = SSdbcore.NewQuery({"
+			SELECT id, timestamp, notetext, adminckey, last_editor, server, crew_playtime
+			FROM [format_table_name("notes")] WHERE ckey=:targetkey ORDER BY timestamp"}, list(
+				"targetkey" = target_sql_ckey
+			))
+		if(!query_get_notes.warn_execute())
+			qdel(query_get_notes)
 			return
 		output += "<h2><center>Notes of [target_ckey]</center></h2>"
 		if(!linkless)
@@ -171,13 +201,12 @@
 				if(last_editor)
 					output += " <font size='2'>Last edit by [last_editor] <a href='?_src_=holder;noteedits=[id]'>(Click here to see edit log)</a></font>"
 			output += "<br>[notetext]<hr style='background:#000000; border:0; height:1px'>"
+		qdel(query_get_notes)
 	else if(index)
 		var/index_ckey
 		var/search
 		output += "<center><a href='?_src_=holder;addnoteempty=1'>\[Add Note\]</a></center>"
 		output += ruler
-		if(!isnum(index))
-			index = sanitizeSQL(index)
 		switch(index)
 			if(1)
 				search = "^."
@@ -185,10 +214,11 @@
 				search = "^\[^\[:alpha:\]\]"
 			else
 				search = "^[index]"
-		var/DBQuery/query_list_notes = GLOB.dbcon.NewQuery("SELECT DISTINCT ckey FROM [format_table_name("notes")] WHERE ckey REGEXP '[search]' ORDER BY ckey")
-		if(!query_list_notes.Execute())
-			var/err = query_list_notes.ErrorMsg()
-			log_game("SQL ERROR obtaining ckey from notes table. Error : \[[err]\]\n")
+		var/datum/db_query/query_list_notes = SSdbcore.NewQuery("SELECT DISTINCT ckey FROM [format_table_name("notes")] WHERE ckey REGEXP :search ORDER BY ckey", list(
+			"search" = search
+		))
+		if(!query_list_notes.warn_execute())
+			qdel(query_list_notes)
 			return
 		to_chat(usr, "<span class='notice'>Started regex note search for [search]. Please wait for results...</span>")
 		message_admins("[usr.ckey] has started a note search with the following regex: [search] | CPU usage may be higher.")
@@ -196,6 +226,7 @@
 			index_ckey = query_list_notes.item[1]
 			output += "<a href='?_src_=holder;shownoteckey=[index_ckey]'>[index_ckey]</a><br>"
 			CHECK_TICK
+		qdel(query_list_notes)
 		message_admins("The note search started by [usr.ckey] has complete. CPU should return to normal.")
 	else
 		output += "<center><a href='?_src_=holder;addnoteempty=1'>\[Add Note\]</a></center>"

code/modules/admin/topic.dm

@@ -962,15 +962,17 @@
 		show_note(index = target)
 
 	else if(href_list["noteedits"])
-		var/note_id = sanitizeSQL("[href_list["noteedits"]]")
-		var/DBQuery/query_noteedits = GLOB.dbcon.NewQuery("SELECT edits FROM [format_table_name("notes")] WHERE id = '[note_id]'")
-		if(!query_noteedits.Execute())
-			var/err = query_noteedits.ErrorMsg()
-			log_game("SQL ERROR obtaining edits from notes table. Error : \[[err]\]\n")
+		var/note_id = text2num(href_list["noteedits"])
+		var/datum/db_query/query_noteedits = SSdbcore.NewQuery("SELECT edits FROM [format_table_name("notes")] WHERE id=:note_id", list(
+			"note_id" = note_id
+		))
+		if(!query_noteedits.warn_execute())
+			qdel(query_noteedits)
 			return
 		if(query_noteedits.NextRow())
 			var/edit_log = query_noteedits.item[1]
 			usr << browse(edit_log,"window=noteedits")
+		qdel(query_noteedits)
 
 	else if(href_list["removejobban"])
 		if(!check_rights(R_BAN))	return
@@ -1080,15 +1082,17 @@
 		usr.client.watchlist_show()
 
 	else if(href_list["watcheditlog"])
-		var/target_ckey = sanitizeSQL("[href_list["watcheditlog"]]")
-		var/DBQuery/query_watchedits = GLOB.dbcon.NewQuery("SELECT edits FROM [format_table_name("watch")] WHERE ckey = '[target_ckey]'")
-		if(!query_watchedits.Execute())
-			var/err = query_watchedits.ErrorMsg()
-			log_game("SQL ERROR obtaining edits from watch table. Error : \[[err]\]\n")
+		var/target_ckey = href_list["watcheditlog"]
+		var/datum/db_query/query_watchedits = SSdbcore.NewQuery("SELECT edits FROM [format_table_name("watch")] WHERE ckey=:targetkey", list(
+			"targetkey" = target_ckey
+		))
+		if(!query_watchedits.warn_execute())
+			qdel(query_watchedits)
 			return
 		if(query_watchedits.NextRow())
 			var/edit_log = query_watchedits.item[1]
 			usr << browse(edit_log,"window=watchedits")
+		qdel(query_watchedits)
 
 	else if(href_list["mute"])
 		if(!check_rights(R_ADMIN|R_MOD))
@@ -2784,15 +2788,17 @@
 
 	else if(href_list["memoeditlist"])
 		if(!check_rights(R_SERVER)) return
-		var/sql_key = sanitizeSQL("[href_list["memoeditlist"]]")
-		var/DBQuery/query_memoedits = GLOB.dbcon.NewQuery("SELECT edits FROM [format_table_name("memo")] WHERE (ckey = '[sql_key]')")
-		if(!query_memoedits.Execute())
-			var/err = query_memoedits.ErrorMsg()
-			log_game("SQL ERROR obtaining edits from memo table. Error : \[[err]\]\n")
+		var/sql_key = href_list["memoeditlist"]
+		var/datum/db_query/query_memoedits = SSdbcore.NewQuery("SELECT edits FROM [format_table_name("memo")] WHERE (ckey=:sql_key)", list(
+			"sql_key" = sql_key
+		))
+		if(!query_memoedits.warn_execute())
+			qdel(query_memoedits)
 			return
 		if(query_memoedits.NextRow())
 			var/edit_log = query_memoedits.item[1]
 			usr << browse(edit_log,"window=memoeditlist")
+		qdel(query_memoedits)
 
 	else if(href_list["secretsfun"])
 		if(!check_rights(R_SERVER|R_EVENT))	return
@@ -3370,13 +3376,14 @@
 
 	// Library stuff
 	else if(href_list["library_book_id"])
-		var/isbn = sanitizeSQL(href_list["library_book_id"])
+		var/isbn = text2num(href_list["library_book_id"])
 
 		if(href_list["view_library_book"])
-			var/DBQuery/query_view_book = GLOB.dbcon.NewQuery("SELECT content, title FROM [format_table_name("library")] WHERE id=[isbn]")
-			if(!query_view_book.Execute())
-				var/err = query_view_book.ErrorMsg()
-				log_game("SQL ERROR viewing book. Error : \[[err]\]\n")
+			var/datum/db_query/query_view_book = SSdbcore.NewQuery("SELECT content, title FROM [format_table_name("library")] WHERE id=:isbn", list(
+				"isbn" = isbn
+			))
+			if(!query_view_book.warn_execute())
+				qdel(query_view_book)
 				return
 
 			var/content = ""
@@ -3393,27 +3400,32 @@
 			popup.set_content(dat)
 			popup.open(0)
 
+			qdel(query_view_book)
 			log_admin("[key_name(usr)] has viewed the book [isbn].")
 			message_admins("[key_name_admin(usr)] has viewed the book [isbn].")
 			return
 
 		else if(href_list["unflag_library_book"])
-			var/DBQuery/query_unflag_book = GLOB.dbcon.NewQuery("UPDATE [format_table_name("library")] SET flagged = 0 WHERE id=[isbn]")
-			if(!query_unflag_book.Execute())
-				var/err = query_unflag_book.ErrorMsg()
-				log_game("SQL ERROR unflagging book. Error : \[[err]\]\n")
+			var/datum/db_query/query_unflag_book = SSdbcore.NewQuery("UPDATE [format_table_name("library")] SET flagged = 0 WHERE id=:isbn", list(
+				"isbn" = isbn
+			))
+			if(!query_unflag_book.warn_execute())
+				qdel(query_unflag_book)
 				return
 
+			qdel(query_unflag_book)
 			log_admin("[key_name(usr)] has unflagged the book [isbn].")
 			message_admins("[key_name_admin(usr)] has unflagged the book [isbn].")
 
 		else if(href_list["delete_library_book"])
-			var/DBQuery/query_delbook = GLOB.dbcon.NewQuery("DELETE FROM [format_table_name("library")] WHERE id=[isbn]")
-			if(!query_delbook.Execute())
-				var/err = query_delbook.ErrorMsg()
-				log_game("SQL ERROR deleting book. Error : \[[err]\]\n")
+			var/datum/db_query/query_delbook = SSdbcore.NewQuery("DELETE FROM [format_table_name("library")] WHERE id=:isbn", list(
+				"isbn" = isbn
+			))
+			if(!query_delbook.warn_execute())
+				qdel(query_delbook)
 				return
 
+			qdel(query_delbook)
 			log_admin("[key_name(usr)] has deleted the book [isbn].")
 			message_admins("[key_name_admin(usr)] has deleted the book [isbn].")
 
@@ -3446,6 +3458,19 @@
 		if(!check_rights(R_ADMIN))
 			return
 		create_ccbdb_lookup(href_list["open_ccbdb"])
+	else if(href_list["slowquery"])
+		if(!check_rights(R_ADMIN))
+			return
+		message_admins("[key_name_admin(usr)] started responding to a query hang report") // So multiple admins dont try file the same report
+		var/answer = href_list["slowquery"]
+		if(answer == "yes")
+			log_sql("[usr.key] | Reported a server hang")
+			if(alert(usr, "Had you just pressed any admin buttons which could lag the server?", "Query server hang report", "Yes", "No") == "Yes")
+				var/response = input(usr,"What were you just doing?","Query server hang report") as null|text
+				if(response)
+					log_sql("[usr.key] | [response]")
+		else if(answer == "no")
+			log_sql("[usr.key] | Reported no server hang. Please investigate")
 
 
 /client/proc/create_eventmob_for(var/mob/living/carbon/human/H, var/killthem = 0)

code/modules/admin/watchlist.dm

@@ -5,31 +5,36 @@
 		var/new_ckey = ckey(clean_input("Who would you like to add to the watchlist?","Enter a ckey",null))
 		if(!new_ckey)
 			return
-		new_ckey = sanitizeSQL(new_ckey)
-		var/DBQuery/query_watchfind = GLOB.dbcon.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey = '[new_ckey]'")
-		if(!query_watchfind.Execute())
-			var/err = query_watchfind.ErrorMsg()
-			log_game("SQL ERROR obtaining ckey from player table. Error : \[[err]\]\n")
+		var/datum/db_query/query_watchfind = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey=:new_ckey", list(
+			"new_ckey" = new_ckey
+		))
+		if(!query_watchfind.warn_execute())
+			qdel(query_watchfind)
 			return
 		if(!query_watchfind.NextRow())
 			to_chat(usr, "<span class='redtext'>[new_ckey] has not been seen before, you can only add known players.</span>")
+			qdel(query_watchfind)
 			return
 		else
 			target_ckey = new_ckey
-	var/target_sql_ckey = sanitizeSQL(target_ckey)
-	if(check_watchlist(target_sql_ckey))
-		to_chat(usr, "<span class='redtext'>[target_sql_ckey] is already on the watchlist.</span>")
+	if(check_watchlist(target_ckey))
+		to_chat(usr, "<span class='redtext'>[target_ckey] is already on the watchlist.</span>")
 		return
 	var/reason = input(usr,"Please state the reason","Reason") as message|null
 	if(!reason)
 		return
-	reason = sanitizeSQL(reason)
-	var/timestamp = SQLtime()
 	var/adminckey = usr.ckey
 	if(!adminckey)
 		return
-	var/admin_sql_ckey = sanitizeSQL(adminckey)
-	var/DBQuery/query_watchadd = GLOB.dbcon.NewQuery("INSERT INTO [format_table_name("watch")] (ckey, reason, adminckey, timestamp) VALUES ('[target_sql_ckey]', '[reason]', '[admin_sql_ckey]', '[timestamp]')")
+	var/datum/db_query/query_watchadd = SSdbcore.NewQuery({"
+		INSERT INTO [format_table_name("watch")] (ckey, reason, adminckey, timestamp)
+		VALUES (:targetkey, :reason, :adminkey, NOW())"},
+		list(
+			"targetkey" = target_ckey,
+			"reason" = reason,
+			"adminkey" = adminckey
+		)
+	)
 	if(!query_watchadd.Execute())
 		var/err = query_watchadd.ErrorMsg()
 		log_game("SQL ERROR during adding new watch entry. Error : \[[err]\]\n")
@@ -37,17 +42,18 @@
 	log_admin("[key_name(usr)] has added [target_ckey] to the watchlist - Reason: [reason]")
 	message_admins("[key_name_admin(usr)] has added [target_ckey] to the watchlist - Reason: [reason]", 1)
 	if(browse)
-		watchlist_show(target_sql_ckey)
+		watchlist_show(target_ckey)
 
 /client/proc/watchlist_remove(target_ckey, browse = 0)
 	if(!check_rights(R_ADMIN))
 		return
-	var/target_sql_ckey = sanitizeSQL(target_ckey)
-	var/DBQuery/query_watchdel = GLOB.dbcon.NewQuery("DELETE FROM [format_table_name("watch")] WHERE ckey = '[target_sql_ckey]'")
-	if(!query_watchdel.Execute())
-		var/err = query_watchdel.ErrorMsg()
-		log_game("SQL ERROR during removing watch entry. Error : \[[err]\]\n")
+	var/datum/db_query/query_watchdel = SSdbcore.NewQuery("DELETE FROM [format_table_name("watch")] WHERE ckey=:target_ckey", list(
+		"target_ckey" = target_ckey
+	))
+	if(!query_watchdel.warn_execute())
+		qdel(query_watchdel)
 		return
+	qdel(query_watchdel)
 	log_admin("[key_name(usr)] has removed [target_ckey] from the watchlist")
 	message_admins("[key_name_admin(usr)] has removed [target_ckey] from the watchlist", 1)
 	if(browse)
@@ -56,30 +62,36 @@
 /client/proc/watchlist_edit(target_ckey, browse = 0)
 	if(!check_rights(R_ADMIN))
 		return
-	var/target_sql_ckey = sanitizeSQL(target_ckey)
-	var/DBQuery/query_watchreason = GLOB.dbcon.NewQuery("SELECT reason FROM [format_table_name("watch")] WHERE ckey = '[target_sql_ckey]'")
-	if(!query_watchreason.Execute())
-		var/err = query_watchreason.ErrorMsg()
-		log_game("SQL ERROR obtaining reason from watch table. Error : \[[err]\]\n")
+	var/datum/db_query/query_watchreason = SSdbcore.NewQuery("SELECT reason FROM [format_table_name("watch")] WHERE ckey=:target_ckey", list(
+		"target_ckey" = target_ckey
+	))
+	if(!query_watchreason.warn_execute())
+		qdel(query_watchreason)
 		return
 	if(query_watchreason.NextRow())
 		var/watch_reason = query_watchreason.item[1]
 		var/new_reason = input("Input the new reason", "New Reason", "[watch_reason]") as message|null
-		new_reason = sanitizeSQL(new_reason)
 		if(!new_reason || new_reason == watch_reason)
 			return
-		var/sql_ckey = sanitizeSQL(usr.ckey)
+		var/sql_ckey = usr.ckey
 		var/edit_text = "Edited by [sql_ckey] on [SQLtime()] from \"[watch_reason]\" to \"[new_reason]\""
-		edit_text = sanitizeSQL(edit_text)
-		var/DBQuery/query_watchupdate = GLOB.dbcon.NewQuery("UPDATE [format_table_name("watch")] SET reason = '[new_reason]', last_editor = '[sql_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE ckey = '[target_sql_ckey]'")
-		if(!query_watchupdate.Execute())
-			var/err = query_watchupdate.ErrorMsg()
-			log_game("SQL ERROR editing watchlist reason. Error : \[[err]\]\n")
+
+		var/datum/db_query/query_watchupdate = SSdbcore.NewQuery("UPDATE [format_table_name("watch")] SET reason=:new_reason, last_editor=:sql_ckey, edits = CONCAT(IFNULL(edits,''), :edit_text) WHERE ckey=:target_ckey", list(
+			"new_reason" = new_reason,
+			"sql_ckey" = sql_ckey,
+			"edit_text" = edit_text,
+			"target_ckey" = target_ckey
+		))
+		if(!query_watchupdate.warn_execute())
+			qdel(query_watchupdate)
+			qdel(query_watchreason)
 			return
+		qdel(query_watchupdate)
 		log_admin("[key_name(usr)] has edited [target_ckey]'s watchlist reason from \"[watch_reason]\" to \"[new_reason]\"")
 		message_admins("[key_name_admin(usr)] has edited [target_ckey]'s watchlist reason from \"[watch_reason]\" to \"[new_reason]\"")
 		if(browse)
-			watchlist_show(target_sql_ckey)
+			watchlist_show(target_ckey)
+	qdel(query_watchreason)
 
 /client/proc/watchlist_show(search)
 	if(!check_rights(R_ADMIN))
@@ -95,11 +107,12 @@
 		search = "^[search]"
 	else
 		search = "^."
-	search = sanitizeSQL(search)
-	var/DBQuery/query_watchlist = GLOB.dbcon.NewQuery("SELECT ckey, reason, adminckey, timestamp, last_editor FROM [format_table_name("watch")] WHERE ckey REGEXP '[search]' ORDER BY ckey")
-	if(!query_watchlist.Execute())
-		var/err = query_watchlist.ErrorMsg()
-		log_game("SQL ERROR obtaining ckey, reason, adminckey, timestamp, last_editor from watch table. Error : \[[err]\]\n")
+
+	var/datum/db_query/query_watchlist = SSdbcore.NewQuery("SELECT ckey, reason, adminckey, timestamp, last_editor FROM [format_table_name("watch")] WHERE ckey REGEXP :search ORDER BY ckey", list(
+		"search" = search
+	))
+	if(!query_watchlist.warn_execute())
+		qdel(query_watchlist)
 		return
 	while(query_watchlist.NextRow())
 		var/ckey = query_watchlist.item[1]
@@ -112,15 +125,19 @@
 			output += " <font size='2'>Last edit by [last_editor] <a href='?_src_=holder;watcheditlog=[ckey]'>(Click here to see edit log)</a></font>"
 		output += "<br>[reason]<hr style='background:#000000; border:0; height:1px'>"
 	usr << browse(output, "window=watchwin;size=900x500")
+	qdel(query_watchlist)
 
 /proc/check_watchlist(target_ckey)
-	var/target_sql_ckey = sanitizeSQL(target_ckey)
-	var/DBQuery/query_watch = GLOB.dbcon.NewQuery("SELECT reason FROM [format_table_name("watch")] WHERE ckey = '[target_sql_ckey]'")
-	if(!query_watch.Execute())
-		var/err = query_watch.ErrorMsg()
-		log_game("SQL ERROR obtaining reason from watch table. Error : \[[err]\]\n")
+	var/datum/db_query/query_watch = SSdbcore.NewQuery("SELECT reason FROM [format_table_name("watch")] WHERE ckey=:target_ckey", list(
+		"target_ckey" = target_ckey
+	))
+	if(!query_watch.warn_execute())
+		qdel(query_watch)
 		return
 	if(query_watch.NextRow())
-		return query_watch.item[1]
+		var/entry = query_watch.item[1]
+		qdel(query_watch)
+		return entry
 	else
+		qdel(query_watch)
 		return 0