this is only 50% right. it can be 1 or 2 or something else.Quote:
really, this don't work xD need check validation $_GET['factionId'], can't enter if var isn't number. 1 or 2 or 3 :p
sorry, i have bad english xD
1 = mmo, 2 = eic, ? = vru.
You can put the request "on hold" replace 3 with anything else like "fhafauk32592398hfak"
but in the end it will still counts for VRU ^^
see init.phpQuote:
Maybe you need to learn SQL
PHP Code:
$_GET = str_replace(['<', '>', '\'', '\'', '\\'], ['<', '>', '"', ''', '\'], $_GET);
every try to inject something will result in a syntax error, so the sql wont get executed
but additionally i would suggest to add
replace
PHP Code:
if (isset($_GET['subaction'], $_GET['factionID']) && $_GET['subaction'] === 'factionChoose' && $_GET['factionID'] > 0 && $_GET['factionID'] < 4):
$mapId = 1;
if ($_GET['factionID'] === 1) {
$mapId = 1;
$x = 1000;
$y = 1000;
} elseif ($_GET['factionID'] === 2) {
$mapId = 5;
$x = 19800;
$y = 1000;
} else {
$mapId = 9;
$x = 19600;
$y = 11900;
};
$MySQLi->query('UPDATE server_1_players SET factionId = ' . $_GET['factionID'] . ', mapId = ' . $mapId . ', x = ' . $x . ', y = ' . $y . ' WHERE playerID = ' . $Users->DataRow['playerID']);
echo 'indexInternal.es.php?action=internalStart';
exit;
endif;
PHP Code:
if (isset($_GET['subaction'], $_GET['factionID']) && $_GET['subaction'] === 'factionChoose' && $_GET['factionID'] > 0 && $_GET['factionID'] < 4):
$faID = (int) ($_GET['factionID'] >= 4) ? 3 : $_GET['factionID'];
$mapId = 1;
if ($faID === '1') {
$mapId = 1;
$x = 1000;
$y = 1000;
} elseif ($faID === '2') {
$mapId = 5;
$x = 19800;
$y = 1000;
} else {
$mapId = 9;
$x = 19600;
$y = 11900;
};
$MySQLi->query('UPDATE server_1_players SET factionId = ' . $faID . ', mapId = ' . $mapId . ', x = ' . $x . ', y = ' . $y . ' WHERE playerID = ' . $Users->DataRow['playerID']);
echo 'indexInternal.es.php?action=internalStart';
exit;
endif;