search

smartaleq / DwarfCraft_orig

A Minecraft RPG mod introducing additional difficulties, levels, and progression.
3 stars 0 forks source link

sql :P #53

Closed dancaselden closed 13 years ago

dancaselden commented 13 years ago

DataManager.java uses dwarf names in sql queries: "//Unsanitized because no one has the player name Robert' Drop Table dwarfs;"

I can spoof arbitrary player names, so ^ is not the case. sanitize dat shit

smartaleq commented 13 years ago

closed because dan's a prick, and anyone who runs an offline server deserves to get sql injected in the backside

dancaselden commented 13 years ago

right -- its chill that we can only get rooted some of the time