mirror of
https://github.com/DarkflameUniverse/DarkflameServer.git
synced 2025-08-04 09:44:10 +00:00
Add proper sanitizing for input to SQLite database.
Adds function `ExecuteQueryWithArgs(query, ...)` to allow for queries with user input. There is a known issue, that the funciton does not work with std::string. All strings must be converted to c strings.
This commit is contained in:
@@ -40,4 +40,18 @@ namespace CDClientDatabase {
|
||||
*/
|
||||
CppSQLite3Query ExecuteQuery(const std::string& query);
|
||||
|
||||
//! Queries the CDClient and parses arguments
|
||||
/*!
|
||||
\param query The query with formatted arguments
|
||||
\return the results of the query
|
||||
*/
|
||||
// Due to the template, implementation must be in the header.
|
||||
template <typename... Args>
|
||||
CppSQLite3Query ExecuteQueryWithArgs(const std::string& query, Args... args) {
|
||||
CppSQLite3Buffer sqlBuf;
|
||||
sqlBuf.format(query.c_str(), args...);
|
||||
|
||||
std::string safe_query = (const char *) sqlBuf;
|
||||
return ExecuteQuery(safe_query);
|
||||
}
|
||||
};
|
||||
|
Reference in New Issue
Block a user