SQL Escape Probleme

Mitglied seit
18.12.2006
Beiträge
2
Reaktionspunkte
0
Beim Testen des Charakterplaners mit Kaz'rogals gehärtetes Herz ist mir aufgefallen, das wohl ein Eintrag im Suchfeld nicht richtig escaped wird. Könnte eventuell für SQL Injections ausgenutzt werden.

sql_error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'rogals gehärtetes Herz%' AND ((items.PvPRank1-4)<=1 OR items.PvPRank1=0) AND Req' at line 1
SELECT gp.color Color, gp.ench_id EnchID, items.*, items.de_ItemName ItemName, items.de_ItemDescription ItemDescription, items.de_ClassName as ClassName, items.de_SubClassName as SubClassName, items.de_SkillName as SkillName, items.de_RequiredSpellName as RequiredSpellName, items.de_ItemSetName as ItemSetName, items.de_FactionName as FactionName, items.de_SpellDesc1 as SpellDesc1, items.de_SpellDesc2 as SpellDesc2, items.de_SpellDesc3 as SpellDesc3, items.de_SpellDesc4 as SpellDesc4, items.de_SpellDesc5 as SpellDesc5 FROM own_joineditems items LEFT JOIN dbc_GemProperties gp ON gp.id = items.GemPropertyID WHERE (items.Class = 2) AND (Classes & 1)>0 AND (SubClass = 0 OR SubClass = 1 OR SubClass = 2 OR SubClass = 3 OR SubClass = 4 OR SubClass = 5 OR SubClass = 6 OR SubClass = 7 OR SubClass = 8 OR SubClass = 10 OR SubClass = 13 OR SubClass = 14 OR SubClass = 15 OR SubClass = 16 OR SubClass = 17 OR SubClass = 18 OR SubClass = 20) AND de_ItemName LIKE '%Kaz'rogals gehärtetes Herz%' AND ((items.PvPRank1-4)<=1 OR items.PvPRank1=0) AND RequiredLevel <= 70 AND ItemLevel >= 40 ORDER BY DPS DESC, Quality DESC, ItemLevel DESC LIMIT 0, 20
 
Zurück