[galadril]

@DarthNinja

Is it possible to track the stats of shooting birds?
http://www.youtube.com/watch?v=6-hbgPzmb2U
http://wiki.teamfortress.com/wiki/Birds

[DarthNinja]

Originally Posted by galadril @DarthNinja Is it possible to track the stats of shooting birds? http://www.youtube.com/watch?v=6-hbgPzmb2U http://wiki.teamfortress.com/wiki/Birds

I don't think there's an event for the shooting the birds, so no.
You can't kill people with them, so you'd only be tracking dove kills to track dove kills. Plus Valve may remove them after the whole medic thing is over.

It would be possible to track them using SDK hooks, but I'd rather avoid that. At least for the moment.

[galadril]

Oke thanks..
Just thinking out loud :-)

[PAL-18]

Is the web interface protected against SQL injection?

[Leonardo]

Originally Posted by PAL-18 Is the web interface protected against SQL injection?

looks like not so

player_class.php

// ...
$ppp = $_GET["ppp"];
// ...
if(empty($class))
{
	$sql .= ' ORDER BY `KILLS` DESC LIMIT '.$fromplayer.','.$ppp.' '; // HACK ME, PLEASE!!!!!11!1ONE
}
// ...

[PAL-18]

Heh i figured as much.

[galadril]

Oke i've changed the $_GET 's on all the pages to also the mysql-real-escape-string function of php to prevent Sql Injection.

http://www.multiupload.com/VOPLTIFGD9


More Info:
http://php.net/manual/en/function.my...ape-string.php

[Leonardo]

fix for numeric variables:
$ppp = (int)$_GET["ppp"];
$ppp = intval($_GET["ppp"]);

[galadril]

Originally Posted by Leonardo fix for numeric variables: $ppp = (int)$_GET["ppp"]; $ppp = intval($_GET["ppp"]);

mysql-real-escape-string is not enough for numeric values?

[Leonardo]

Originally Posted by galadril mysql-real-escape-string is not enough for numeric values?

it's just a harder way