joshdeck
/
TheShopCritics2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adjustments to ensure SQL injection immunity

This commit is contained in:
Josh Deck 2024-08-22 08:24:37 -04:00
parent 2c967f701f
commit b0739e019a
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
TSC2/Components/CSharp/DatabaseManager.cs
View File

@ -59,9 +59,9 @@ namespace TSC2.Components.CSharp
MySqlConnection conn = new MySqlConnection(_connectionString); MySqlConnection conn = new MySqlConnection(_connectionString);
conn.Open(); conn.Open();
using (var cmd = new MySqlCommand("SELECT * FROM userinformation WHERE Platform='Google' AND Token='" + MainLayout.Session["id"] + "'", conn)) using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM userinformation WHERE Platform='Google' AND Token=@Token) AS result", conn))
using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM userinformation WHERE Platform='Google' AND Token='" + MainLayout.Session["id"] + "') AS result", conn))
{ {
count_cmd.Parameters.AddWithValue("@Token", MainLayout.Session["id"]);
int count = Convert.ToInt32(count_cmd.ExecuteScalar()); int count = Convert.ToInt32(count_cmd.ExecuteScalar());
if (count == 0) // User is not already in our database if (count == 0) // User is not already in our database
@ -98,9 +98,9 @@ namespace TSC2.Components.CSharp
MySqlConnection conn = new MySqlConnection(_connectionString); MySqlConnection conn = new MySqlConnection(_connectionString);
conn.Open(); conn.Open();
using (var cmd = new MySqlCommand("SELECT * FROM userinformation WHERE Platform='Facebook' AND Token='" + MainLayout.Session["id"] + "'", conn)) using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM userinformation WHERE Platform='Facebook' AND Token=@Token) AS result", conn))
using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM userinformation WHERE Platform='Facebook' AND Token='" + MainLayout.Session["id"] + "') AS result", conn))
{ {
count_cmd.Parameters.AddWithValue("@Token", MainLayout.Session["id"]);
int count = Convert.ToInt32(count_cmd.ExecuteScalar()); int count = Convert.ToInt32(count_cmd.ExecuteScalar());
if (count == 0) // User is not already in our database if (count == 0) // User is not already in our database
@ -148,8 +148,9 @@ namespace TSC2.Components.CSharp
// Set review ID to a combination of the user's unique id and the shop's // Set review ID to a combination of the user's unique id and the shop's
var reviewID = MainLayout.Session["id"] + "~~" + shopID; var reviewID = MainLayout.Session["id"] + "~~" + shopID;
using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM reviews WHERE ReviewID='" + reviewID + "') AS result", conn)) using (var count_cmd = new MySqlCommand("SELECT COUNT(*) FROM (SELECT * FROM reviews WHERE ReviewID=@reviewID) AS result", conn))
{ {
count_cmd.Parameters.AddWithValue("@reviewID", reviewID);
int count = Convert.ToInt32(count_cmd.ExecuteScalar()); int count = Convert.ToInt32(count_cmd.ExecuteScalar());
if (count == 0) if (count == 0)
{ {
@ -172,7 +173,7 @@ namespace TSC2.Components.CSharp
} }
catch (Exception ex) catch (Exception ex)
{ {
await Console.Out.WriteLineAsync(ex.Message); await Console.Out.WriteLineAsync("An exception occured when adding review.");
} }
} }
else else
@ -189,7 +190,8 @@ namespace TSC2.Components.CSharp
MySqlConnection conn = new MySqlConnection(_connectionString); MySqlConnection conn = new MySqlConnection(_connectionString);
conn.Open(); conn.Open();
var cmd = new MySqlCommand("SELECT * FROM reviews WHERE ReviewID LIKE '%~~" + shopID + "'", conn); var cmd = new MySqlCommand("SELECT * FROM reviews WHERE ReviewID LIKE CONCAT('%~~', @shopID, '%');", conn);
cmd.Parameters.AddWithValue("@shopID", shopID);
MySqlDataReader reader = cmd.ExecuteReader(); MySqlDataReader reader = cmd.ExecuteReader();
List<string> reviews = new(); List<string> reviews = new();
@ -208,7 +210,8 @@ namespace TSC2.Components.CSharp
MySqlConnection conn = new MySqlConnection(_connectionString); MySqlConnection conn = new MySqlConnection(_connectionString);
conn.Open(); conn.Open();
var cmd = new MySqlCommand("SELECT * FROM reviews WHERE ReviewID LIKE '%~~" + shopID + "'", conn); var cmd = new MySqlCommand("SELECT * FROM reviews WHERE ReviewID LIKE CONCAT('%~~', @shopID, '%');", conn);
cmd.Parameters.AddWithValue("@shopID", shopID);
MySqlDataReader reader = cmd.ExecuteReader(); MySqlDataReader reader = cmd.ExecuteReader();
List<int> scores = new(); List<int> scores = new();