From f396b94068616fec971943d43650c034e234ba2d Mon Sep 17 00:00:00 2001 From: MrStonedOne Date: Fri, 8 Aug 2014 00:15:33 -0700 Subject: [PATCH 1/2] SQL injection fix. Google sanitizing sql input. almost every single article explains why you should never attempt to roll your own function to do this. --- code/__HELPERS/text.dm | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index af77addeab0..adee6bb7c89 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -15,9 +15,7 @@ // Run all strings to be used in an SQL query through this proc first to properly escape out injection attempts. /proc/sanitizeSQL(var/t as text) - var/sanitized_text = replacetext(t, "'", "\\'") - sanitized_text = replacetext(sanitized_text, "\"", "\\\"") - return sanitized_text + return dbcon.Quote(t); /* * Text sanitization From 873c15178cfed20e58a54ead0a45dc0da88a0af2 Mon Sep 17 00:00:00 2001 From: MrStonedOne Date: Fri, 8 Aug 2014 22:32:56 -0700 Subject: [PATCH 2/2] Fixes sql errors caused by odd and unexpected behavor in dbcon.Quote() --- code/__HELPERS/text.dm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index adee6bb7c89..15d93b5563f 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -15,7 +15,8 @@ // Run all strings to be used in an SQL query through this proc first to properly escape out injection attempts. /proc/sanitizeSQL(var/t as text) - return dbcon.Quote(t); + var/sqltext = dbcon.Quote(t); + return copytext(sqltext, 2, lentext(sqltext)-1);//Quote() adds quotes around input, we already do that /* * Text sanitization