[duydangle]

I'm having some problems. I'm making a plugin, a registered system. You have to register to play on the server. That's like a username/password system. But I'm having some errors (Check the attachment). Take it a look, thank you so much.

#include <sourcemod>

new Handle:db

public Plugin:myinfo =
{
    name = "User Register System",
    author = "Mucno, duydangle",
    description = "A verify system.",
    version = "1.0",
    url = ""
}

new const String:AUTHMETHOD_RESTRICT[] = "default"

public OnPluginStart()
{
    CreateAuthMethod(AUTHMETHOD_RESTRICT)
    decl String:error[255]

    if (SQL_CheckConfig("admins"))
    {
        db = SQL_Connect("admins", true, error, sizeof(error))
    } else {
        db = SQL_Connect("default", true, error, sizeof(error))
    }

    if (db == INVALID_HANDLE)
    {
        LogError("Could not connect to database \"default\": %s", error)
        return
    }
}

public OnClientPutInServer(Client)
{
    new Handle:hQuery1
    new Handle:hQuery2
    new bool:FoundName = false
    new bool:FoundPass = false
    new String:Password[36],String:ClientPassword[36]
    new String:Name[36],String:ClientName[36]
    GetClientInfo(Client,"_name",ClientName,sizeof(ClientName))
    GetClientInfo(Client,"_pw",ClientPassword,sizeof(ClientPassword))
    hQuery1 = SQL_Query(db,"SELECT name FROM verifysystem")
    while ( SQL_FetchRow(hQuery1) )
        {
        SQL_FetchString(hQuery1,0,Name,sizeof(Name))
        if(StrEqual(Name,ClientName,false))
            FoundName = true
        }
    if(FoundName)
    {
        hQuery2 = SQL_Query(db,"SELECT password FROM verifysystem Where name = ClientName")
        while ( SQL_FetchRow(hQuery2) )
            {
                SQL_FetchString(hQuery2,0,Password,sizeof(Password))
                if(StrEqual(Password,ClientPassword,false))
            FoundPass = true
            }
    }
    if (FoundPass == false)
    {
        KickClient(Client,"You don't have access to this server")
    }
    CloseHandle(hQuery1)
    CloseHandle(hQuery2)

}

//A friend told me that the problem in this:

 hQuery2 = SQL_Query(db,"SELECT password FROM verifysystem WHERE name = ClientName")

He said SQL_Query can't understand ClientName's value.

//sorry for my bad English.

[duydangle]

It's just a draft, and it's being developed. Take it a look. I appreciate you guys so much.

//My table has 3 colums: ID (auto-number), Name and Password.

[Leonardo]

PHP Code:

new String:query[256];
new Handle:result;
Format(query, sizeof(query), "SELECT `password` FROM `verifysystem` WHERE `name` = '%s'", ClientName);
if((result = SQL_Query(db,query)) == INVALID_HANDLE)
{
    PrintToServer("[DB Error] Invalid Query");
    CloseHandle(result);
}
else
{
    // do what you want
} 


[duydangle]

Thank you so much. Problem solved, I'm developing its features

[Scone]

There's a serious security issue in that code - the client's name isn't being escaped. If they set their name to, for example:

';DROP TABLE verifysystem;SELECT '

Your query becomes this:

SELECT `password` FROM `verifysystem` WHERE `name` = '';DROP TABLE verifysystem;SELECT ''

You're giving every user complete access to your database. Also, it will fail for all non-malicious users who have quotes in their name. See SQL_EscapeString in the API docs for more info.

[Scone]

Originally Posted by jonnybbush you have to drop your table and create a new table with the select command

This man knows his stuff.

[duydangle]

I'm fixing security risk. Thank you.

If someone share his account, how can be he automatically kicked?

Originally Posted by jonnybbush This is a security issue you have to drop your table and create a new table with the select command using this you have to easy find your query and solve faster so please change your older query with new query.

Can you explain more specifically?

[duydangle]

I think the security risk can be solved by not accepting special symbols when signing up.

[daryematera]

This is a security problem it is necessary to drop the table and create a new table, select the command that is easy for you to find the query, and to resolve more quickly and use some simple query you can easily find their information, and its high level of work in your experience.

[FaTony]

I wonder why not to use SteamID... Only non-steam pops up.