[Release - Hack/Exploit] Login To Anyones accounts on Binary servers

bool CUserList::LoginUser(LPCTSTR szAccount, LPCTSTR szPassword, SOCKET_ID idSocket)	// ½öÓÃÓÚ·ÇÕʺŷþÎñÆ÷Æô¶¯
{
#ifdef	ACCOUNT_ENABLE
	return false;
#endif
	bool	bRet = false;
	SQLBUF	szSQL;
	sprintf(szSQL, "SELECT id, name, account_id, recordmap_id FROM %s WHERE account='%s' && password='%s'", _TBL_USER, szAccount, szPassword);
	IRecordset*	pRes = GameWorld()->GetDatabase()->CreateNewRecordset(szSQL);		//VVVVVVVVVVVVVVVVVVVVVVVV
	if(pRes)
	{
		OBJID	idUser	= pRes->LoadDWord("id");
		NAMESTR	szName = "ÎÞ";
		pRes->LoadString(szName, "name", _MAX_NAMESIZE);
		OBJID	idAccount	= pRes->LoadDWord("account_id");
		OBJID	idMap	= pRes->LoadDWord("recordmap_id");
		PROCESS_ID	idProcess	= MapList()->GetMapProcessID(idMap);
		ASSERT (idProcess != PROCESS_NONE);
		int		nLevel	= 0;		// δÕʺŷþÎñÆ÷µÇ¼£¬²»ÐèÒªµÈ¼¶
		CreateUser(idProcess, idUser, szName, idAccount, idSocket, nLevel, szAccount);

		bRet = true;
		pRes->Release();;		//AAAAAAAAAAAAAAAAAAAAAAAAAA

		GameWorld()->SendFee(idAccount, CMsgFee_A::FEE_BEGIN);
	}

	{
		m_nPlayerAmount++;
		if(m_nMaxPlayerAmount < m_nPlayerAmount)
			m_nMaxPlayerAmount = m_nPlayerAmount;
		extern struct STAT_STRUCT	g_stat;
		InterlockedExchange(&g_stat.nAllPlayers, m_nPlayerAmount);
		InterlockedExchange(&g_stat.nMaxPlayers, m_nMaxPlayerAmount);
		InterlockedIncrement(&g_stat.nLoginPlayers);
	}
	return bRet;
}

void InsertBackslash(char * bufTarget, const char * pszSource)
{
	const char * pSour = pszSource;
	char * pTarg = bufTarget;
	while(*pSour)
	{
		if(*pSour == '\\' || *pSour == '\'')
			*(pTarg++) = '\\';

		*(pTarg++) = *(pSour++);
	}
	*pTarg = 0;
}

//////////////////////////////////////////////////////////////////////
// password == "" ±íʾ²»¼ì²éÃÜÂë
BOOL CAccount::Create(const char* pszName, const char* pszPassword)
{
	try{
		if(!pszName || _MAX_NAMESIZE <= strlen(pszName))
			return false;

		if(!pszPassword || _MAX_PSWSIZE <= strlen(pszPassword))
			return false;

		if (m_pRes != NULL)
		{
			::LogSave("WARNING: CAccount::Create() m_pRes not NULL.");
			this->Destroy();
		}

		char bufName[256];
		InsertBackslash(bufName, pszName); //
//		if(strchr(pszName, '\'') || strchr(pszName, '\\'))			// µ¥ÒýºÅ(')³£Á¿ºÍ·´Ð±¸Ü(\)³£Á¿
		{
//			::LogSave("ERROR: Login with illegal username [%s]. can't login.", pszName);	//¡ï DEBUG
//			return false;
		}

		char bufPassword[256];
		InsertBackslash(bufPassword, pszPassword);
//		if(strchr(pszPassword, '\'') || (strlen(pszPassword) && pszPassword[strlen(pszPassword)-1] == '\\'))	// µ¥ÒýºÅ(')³£Á¿ºÍ·´Ð±¸Ü(\)³£Á¿
//		if(strchr(pszPassword, '\'') || strchr(pszPassword, '\\'))	// µ¥ÒýºÅ(')³£Á¿ºÍ·´Ð±¸Ü(\)³£Á¿
		{
//			::LogSave("ERROR: Login with illegal password [%s]. can't login.", pszPassword);	//¡ï DEBUG
//			return false;
		}

		m_pRes = new CMyRecordset(&g_db);
		if(!m_pRes)
		{
			::LogSave("ERROR: CAccount::Create() can't new CMyRecordset object.");
			return false;
		}
		if(bufPassword[0])
			sprintf(m_szSQL, SQL_ACCOUNT_STMT, POINTTABLE, bufName, bufPassword);
		else
			sprintf(m_szSQL, SQL_ACCOUNT_STMT2, POINTTABLE, bufName);

		if (!m_pRes->Open(m_szSQL))  
		{	
			::LogSave("ERROR: CAccount::Create(char*) can't Open() database for [%s]", m_szSQL);
			delete m_pRes;
			m_pRes = NULL;
			return false;
		}

		if (m_pRes->RecordCount() == 0)  
		{	
			m_pRes->Close();
			delete m_pRes;
			m_pRes = NULL;
			return false;
		}

		if(!this->LoadInfo())
		{
			::LogSave("ERROR: CAccount::Create() can't LoadInfo()");
			return false;
		}

		return true;
	}
	catch(...)
	{
		::LogSave("exception catch at CAccount::Create(%s).", pszName);
		return false;
	}
}