Core/Logging: Use prepared statements in AppenderDB

2 files changed, 9 insertions, 4 deletions

diff --git a/src/server/shared/Database/Implementation/LoginDatabase.cpp b/src/server/shared/Database/Implementation/LoginDatabase.cpp
index 028d927a720..31d9f5ec1f6 100755
--- a/src/server/shared/Database/Implementation/LoginDatabase.cpp
+++ b/src/server/shared/Database/Implementation/LoginDatabase.cpp
@@ -59,7 +59,7 @@ void LoginDatabaseConnection::DoPrepareStatements()
     PREPARE_STATEMENT(LOGIN_INS_REALM_CHARACTERS_INIT, "INSERT INTO realmcharacters (realmid, acctid, numchars) SELECT realmlist.id, account.id, 0 FROM realmlist, account LEFT JOIN realmcharacters ON acctid=account.id WHERE acctid IS NULL", CONNECTION_ASYNC);
     PREPARE_STATEMENT(LOGIN_UPD_EXPANSION, "UPDATE account SET expansion = ? WHERE id = ?", CONNECTION_ASYNC);
     PREPARE_STATEMENT(LOGIN_UPD_ACCOUNT_LOCK, "UPDATE account SET locked = ? WHERE id = ?", CONNECTION_ASYNC);
-    PREPARE_STATEMENT(LOGIN_INS_LOG, "INSERT INTO logs (time, realm, type, string) VALUES (UNIX_TIMESTAMP(), ? , ?, ?)", CONNECTION_ASYNC);
+    PREPARE_STATEMENT(LOGIN_INS_LOG, "INSERT INTO logs (time, realm, type, level, string) VALUES (?, ?, ?, ?, ?)", CONNECTION_ASYNC);
     PREPARE_STATEMENT(LOGIN_UPD_USERNAME, "UPDATE account SET v = 0, s = 0, username = ?, sha_pass_hash = ? WHERE id = ?", CONNECTION_ASYNC);
     PREPARE_STATEMENT(LOGIN_UPD_PASSWORD, "UPDATE account SET v = 0, s = 0, sha_pass_hash = ? WHERE id = ?", CONNECTION_ASYNC);
     PREPARE_STATEMENT(LOGIN_UPD_MUTE_TIME, "UPDATE account SET mutetime = ? WHERE id = ?", CONNECTION_ASYNC);
diff --git a/src/server/shared/Logging/AppenderDB.cpp b/src/server/shared/Logging/AppenderDB.cpp
index 0254ec72bd0..8836be2b24a 100644
--- a/src/server/shared/Logging/AppenderDB.cpp
+++ b/src/server/shared/Logging/AppenderDB.cpp
@@ -37,9 +37,14 @@ void AppenderDB::_write(LogMessage& message)
         case LOG_FILTER_SQL_DRIVER:
         case LOG_FILTER_SQL_DEV:
             break; // Avoid infinite loop, PExecute triggers Logging with LOG_FILTER_SQL type
-        default:
-            LoginDatabase.PExecute("INSERT INTO logs (time, realm, type, level, string) "
-            "VALUES (" UI64FMTD ", %u, %u, %u, '%s');", message.mtime, realm, message.type, message.level, message.text.c_str());
+        default: 
+            PreparedStatement* stmt = CharacterDatabase.GetPreparedStatement(LOGIN_INS_LOG);
+            stmt->setUInt64(0, message.mtime);
+            stmt->setUInt32(1, realm);
+            stmt->setUInt8(2, message.type);
+            stmt->setUInt8(3, message.level);
+            stmt->setString(4, message.text);
+            LoginDatabase.Execute(stmt);
             break;
     }
 }