[LIB] getGuildLeader(GuildName)

[Critico]

050-function

function getGuildLeaderName(GuildName) -- function by vodkart
	local leader = db.getResult("SELECT `players`.`name` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("name")
	end
	return nil
end

Version with one query to mysql By PhoOwned ~

function getGuildLeaderGUID(GuildName)
	local leader = db.getResult("SELECT `players`.`id` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("id")
	end
	return nil
end
[/LUa]




[B]example talk[/B]:
[code=lua]
function onSay(cid, words, param)

local player = getPlayerByName(param)
if param == '' then
return doPlayerSendCancel(cid, "param not valid.")
elseif (not player or isPlayerGhost(player)) then
return doPlayerSendTextMessage(cid, MESSAGE_STATUS_CONSOLE_BLUE, "Player with this name doesn\'t exist or is offline.")
elseif getPlayerGuildId(player) <= 0  then
return doPlayerSendCancel(cid, "player are not a guild member.")
end
local leader = getGuildLeaderName(getPlayerGuildName(player))
return doPlayerSendTextMessage(cid,MESSAGE_STATUS_CONSOLE_BLUE,'Leader Name is '..leader..'')
end

/yourcomand PLAYERNAME

or example actions:

members/vicelider add item for only guild leader

function onUse(cid, item, frompos, item2, topos)

local leader,pid = getGuildLeaderName(getPlayerGuildName(cid)),getPlayerByName(leader)
local item = 2400

if getPlayerGuildId(cid) <= 0  then
return doPlayerSendCancel(cid, "You are not a guild member.")
elseif (not pid or isPlayerGhost(pid)) then
return doPlayerSendCancel(cid, "Sorry, The Leader [".. leader .."] is offline and will not receive the item!")
end
doPlayerAddItem(pid,item,1)
return TRUE
end

 

[TheMaX]

nice vodkart

So confuse, but nice.

 

[Darkhaos]

Parameter "cid" is useless

 

[Critico]

@UP
lol
thanks
script edited

@Max
haha xD
yes somewhat
^^

 

[PhoOwned]

Version with one query to mysql and E S C A P E S T R I N G!!
(without db.escapeString and with your talkaction it's possible to hack database [add in name ' and then your modified query] on some wrong configured servers [90% servers ])

function getGuildLeaderGUID(GuildName) 
	local leader = db.getResult("SELECT `players`.`id` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("id")
	end
	return nil
end
 
function getGuildLeaderName(GuildName) -- function by vodkart
	local leader = db.getResult("SELECT `players`.`name` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("name")
	end
	return nil
end

EDIT:
@down
Ye. I just copied and edited script in notepad, not tested. Thank for fix. POST UPDATED.

 

[Critico]

@UP
Thank a lot, I started recently with database

but have one erro

local leader
if(rank:getID() ~= -1) then -- not is rank...

fix script :

function getGuildLeaderGUID(GuildName) 
	local leader = db.getResult("SELECT `players`.`id` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("id")
	end
	return nil
end
 
function getGuildLeaderName(GuildName) -- function by vodkart
	local leader = db.getResult("SELECT `players`.`name` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("name")
	end
	return nil
end

 

[Mock]

Version with one query to mysql and E S C A P E S T R I N G!!
(without db.escapeString and with your talkaction it's possible to hack database [add in name ' and then your modified query] on some wrong configured servers [90% servers ])

function getGuildLeaderGUID(GuildName) 
	local leader = db.getResult("SELECT `players`.`id` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("id")
	end
	return nil
end
 
function getGuildLeaderName(GuildName) -- function by vodkart
	local leader = db.getResult("SELECT `players`.`name` FROM `players` WHERE `players`.`id` = (SELECT `guilds`.`ownerid` FROM `guilds` WHERE `guilds`.`name` = ".. db.escapeString(GuildName) .. ")")
	if(leader:getID() ~= -1) then  
		return leader:getDataString("name")
	end
	return nil
end

EDIT:
@down
Ye. I just copied and edited script in notepad, not tested. Thank for fix. POST UPDATED.

Nice! Sql inject in otserv ;D

/yourcomand PLAYERNAME'); delete * from players; SELECT * from players WHERE `id` = (select * from players);

and then bye all XD

 

[PhoOwned]

Nice! Sql inject in otserv ;D

/yourcomand PLAYERNAME'); delete * from players; SELECT * from players WHERE `id` = (select * from players);

and then bye all XD

Ye. I hate SQL Injections