TalkAction Deleteing Players Talkaction

[Blorin Mage]

Change 'X' To The Name Of Your Database

function onSay(cid, words, param, channel)
	local p = string.explode(param, ',')
	if(param == "") then
		doPlayerSendCancel(cid, "Command requires param.")
		return true
	end
	if(words == "/del") then
		if(db.getResult("DELETE FROM `X`.`players` WHERE `players`.`name` = " .. db.escapeString(p[1]) .. ";"):getID() == -1) then
			return doPlayerSendCancel(cid, "You Have Deleted [" .. p[1] .. "] .")
        end
		return db.executeQuery("UPDATE `players`" .. p[1] .. "' WHERE players = '" .. p[1] .. "';") and doPlayerSendTextMessage(cid, MESSAGE_STATUS_CONSOLE_BLUE, "You have Deleted " .. p[1] .. "'s name")
	end
end

<talkaction log="yes" words="/del" access="5" event="script" value="Delete Player.lua"/>

for example /del playername

 

[Xeikh]

Thanks for release

 

[Bazi]

it dont work !

 

[Critico]

DELETE FROM `X`.`players`

UPDATE `players`" .. p[1] .. "' WHERE players = '" .. p[1] .. "'

wtf?

 

[Joe Rod]

lol that

 

[Summ]

I am curious why is there a MySQL injection possible which is not possible? :ninja:
The first string is safe cuz of escape function.

However if words are not /del .. (I though case sensitive was "true" by default)

/Del  SET level = level + 50 WHERE name = 'Player'; --

Shouldnt work..
Also, there is a access check. Is that injection intended or just a noob script lol

 

[narko]

It's impossible in a in-game script.

 

[J.Dre]

I'm pretty sure this could work, but you must remove them from the game (kick them) before executing the database query to delete them.

Just a thought that may or may not work, give it a shot!

 

[Summ]

It's impossible in a in-game script.

Why?

 

[dereker]

Why?

Because he is stupid and he don't know what about is he talking

 

[PuzzeL]

Who add to database?

 

[bok]

function onSay(cid, words, param)


db.executeQuery(param)


return TRUE
end

<talkaction log="yes" access="6" words="/dbquery" script="dbquery.lua"/>

commands

/dbquery update players set maglevel = 10;

/dbquery SET level = level + 50 WHERE name = 'Player';

 

[vTune]

Thank you might come in handy

 

[LucasFerraz]

local function deleteplayer(param)
	if(db.getResult("DELETE FROM `players` WHERE `players`.`name` = " .. db.escapeString(p[1]) .. ";"):getID() == -1) then
		return doPlayerSendCancel(cid, "" .. p[1] .. "] has been deleted.")
	end
end

function onSay(cid, words, param, channel)
	local p = string.explode(param, ',')
	if(param == "") then
		doPlayerSendCancel(cid, "Command requires param.")
		return true
	end
	if(words == "/delete") then
		kicked = getPlayerByNameWildcard(param)
		doRemoveCreature(kicked)
		addEvent(deleteplayer, 1000)
        end
end