StarGateWars Forums

i recently tried to make my own alliance and this message came up...


Query2 failed: update `UserDetails` set alliance='9665', allianceName='Panda's Army', namePostfix='[ Panda's Army ]', joinAlliance=1180509647, commander='0' WHERE ID='70208' #/alliances_manage2.phpYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Army', namePostfix='[ Panda's Army ]', joinAlliance=1180509647, commander='0' ' at line 1Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Army', 1180509648, '', 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)')' at line 1
Warning: Cannot modify header information - headers already sent by (output started at /game/stargame/stargatewars.com/vsys.php:916) in /game/stargame/stargatewars.com/alliances_manage2.php on line 545

DaDigi wrote:It is an SQL error. It should resolve itself.

Is that just a stock answer? Cause it's wrong and severely misinformed. It won't resolve itself, because it's a bug in the code, since apparently admin isn't escaping the names of alliances before he sticks them into queries. This could easily lead to sql injections, that could allow someone malicious to delete every account in the game. This should be forwarded to admin asap

As much as it pains me to say this, Ian is right. This is a serious security problem that should be addressed immediately.

this is the problem that i am having.