From 12e55a04bb14f4a56576dcc0ead35e996d7dcc7d Mon Sep 17 00:00:00 2001 From: leak Date: Sat, 24 Mar 2012 01:25:08 +0100 Subject: Core/DBLayer: Convert PQuery() queries to prepared statements --- src/server/game/Tools/PlayerDump.cpp | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) (limited to 'src/server/game/Tools') diff --git a/src/server/game/Tools/PlayerDump.cpp b/src/server/game/Tools/PlayerDump.cpp index 900fcf7392a..8d5d16d22b9 100644 --- a/src/server/game/Tools/PlayerDump.cpp +++ b/src/server/game/Tools/PlayerDump.cpp @@ -406,7 +406,10 @@ DumpReturn PlayerDumpReader::LoadDump(const std::string& file, uint32 account, s bool incHighest = true; if (guid != 0 && guid < sObjectMgr->_hiCharGuid) { - result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE guid = '%d'", guid); + PreparedStatement* stmt = CharacterDatabase.GetPreparedStatement(CHAR_SEL_CHECK_GUID); + stmt->setUInt32(0, guid); + PreparedQueryResult result = CharacterDatabase.Query(stmt); + if (result) guid = sObjectMgr->_hiCharGuid; // use first free if exists else incHighest = false; @@ -420,8 +423,10 @@ DumpReturn PlayerDumpReader::LoadDump(const std::string& file, uint32 account, s if (ObjectMgr::CheckPlayerName(name, true) == CHAR_NAME_SUCCESS) { - CharacterDatabase.EscapeString(name); // for safe, we use name only for sql quearies anyway - result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str()); + PreparedStatement* stmt = CharacterDatabase.GetPreparedStatement(CHAR_SEL_CHECK_NAME); + stmt->setString(0, name); + PreparedQueryResult result = CharacterDatabase.Query(stmt); + if (result) name = ""; // use the one from the dump } @@ -524,9 +529,11 @@ DumpReturn PlayerDumpReader::LoadDump(const std::string& file, uint32 account, s { // check if the original name already exists name = getnth(line, 3); - CharacterDatabase.EscapeString(name); - result = CharacterDatabase.PQuery("SELECT 1 FROM characters WHERE name = '%s'", name.c_str()); + PreparedStatement* stmt = CharacterDatabase.GetPreparedStatement(CHAR_SEL_CHECK_NAME); + stmt->setString(0, name); + PreparedQueryResult result = CharacterDatabase.Query(stmt); + if (result) if (!changenth(line, 37, "1")) // characters.at_login set to "rename on login" ROLLBACK(DUMP_FILE_BROKEN); -- cgit v1.2.3