From d670aa46177a13ed88bdfc548b1aeda099ee0993 Mon Sep 17 00:00:00 2001 From: Krausus Date: Fri, 19 Aug 2016 20:34:44 -0400 Subject: [PATCH] Adds sanitization to custom item queries --- code/modules/customitems/item_spawning.dm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/modules/customitems/item_spawning.dm b/code/modules/customitems/item_spawning.dm index 345bf6e164e..11df4b13cf9 100644 --- a/code/modules/customitems/item_spawning.dm +++ b/code/modules/customitems/item_spawning.dm @@ -3,7 +3,7 @@ return // Grab the info we want. - var/DBQuery/query = dbcon.NewQuery("SELECT cuiPath, cuiPropAdjust, cuiJobMask, cuiDescription, cuiItemName FROM [format_table_name("customuseritems")] WHERE cuiCKey='[M.ckey]' AND (cuiRealName='[M.real_name]' OR cuiRealName='*')") + var/DBQuery/query = dbcon.NewQuery("SELECT cuiPath, cuiPropAdjust, cuiJobMask, cuiDescription, cuiItemName FROM [format_table_name("customuseritems")] WHERE cuiCKey='[M.ckey]' AND (cuiRealName='[sanitizeSQL(M.real_name)]' OR cuiRealName='*')") query.Execute() while(query.NextRow())