{"action":"created","issue":{"url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/204","repository_url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server","labels_url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/204/comments","events_url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/204/events","html_url":"https://github.com/jacob-grahn/platform-racing-2-server/issues/204","id":297915216,"number":204,"title":"Difficult to create scripts that use the database","user":{"login":"bls1999","id":5680237,"avatar_url":"https://avatars1.githubusercontent.com/u/5680237?v=4","gravatar_id":"","url":"https://api.github.com/users/bls1999","html_url":"https://github.com/bls1999","followers_url":"https://api.github.com/users/bls1999/followers","following_url":"https://api.github.com/users/bls1999/following{/other_user}","gists_url":"https://api.github.com/users/bls1999/gists{/gist_id}","starred_url":"https://api.github.com/users/bls1999/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bls1999/subscriptions","organizations_url":"https://api.github.com/users/bls1999/orgs","repos_url":"https://api.github.com/users/bls1999/repos","events_url":"https://api.github.com/users/bls1999/events{/privacy}","received_events_url":"https://api.github.com/users/bls1999/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-02-16T20:47:51Z","updated_at":"2018-02-20T03:33:21Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"@jacob-grahn \r\n\r\nIt's not very easy for me to create scripts that use db functions because 1) I have no idea what requests are sent to the db and 2) I don't know the db structure.  Could you release the MySQL queries that are being executed when we do something like this?\r\n\r\n`$user = $db->grab_row('user_select', array($user_id), 'Could not find a user with that name.');`\r\n\r\nI assume they're in a php file somewhere.\r\n\r\nFor instance; In this example, I know that `user_select` is the function, `array($user_id)` is what's passed to the function, and `Could not find a user with that name.` is the custom error.  But what exactly does `user_select` do?\r\n\r\nKnowing this information would make it a lot easier for people like me to add tools to the game that require custom database functions or queries."},"comment":{"url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/comments/366857792","html_url":"https://github.com/jacob-grahn/platform-racing-2-server/issues/204#issuecomment-366857792","issue_url":"https://api.github.com/repos/jacob-grahn/platform-racing-2-server/issues/204","id":366857792,"user":{"login":"aaaaaa123456789","id":6129020,"avatar_url":"https://avatars0.githubusercontent.com/u/6129020?v=4","gravatar_id":"","url":"https://api.github.com/users/aaaaaa123456789","html_url":"https://github.com/aaaaaa123456789","followers_url":"https://api.github.com/users/aaaaaa123456789/followers","following_url":"https://api.github.com/users/aaaaaa123456789/following{/other_user}","gists_url":"https://api.github.com/users/aaaaaa123456789/gists{/gist_id}","starred_url":"https://api.github.com/users/aaaaaa123456789/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaaaaa123456789/subscriptions","organizations_url":"https://api.github.com/users/aaaaaa123456789/orgs","repos_url":"https://api.github.com/users/aaaaaa123456789/repos","events_url":"https://api.github.com/users/aaaaaa123456789/events{/privacy}","received_events_url":"https://api.github.com/users/aaaaaa123456789/received_events","type":"User","site_admin":false},"created_at":"2018-02-20T03:33:21Z","updated_at":"2018-02-20T03:33:21Z","author_association":"NONE","body":"It's basically a matter of parsing.\r\n\r\nConsider the traditional example of SQL injection:\r\n\r\n```sql\r\nSELECT uid FROM users WHERE username = '$user' AND password = '$pass' LIMIT 1\r\n```\r\n\r\nI'm sure you know how that can be broken — you have to pass a string that breaks out of the string quotes. Escaping helps solve this issue, but as I said above, escaping is a fragile mechanism.\r\n\r\nNow consider the prepared version of that query:\r\n\r\n```sql\r\nSELECT uid FROM users WHERE username = ? AND password = ? LIMIT 1\r\n```\r\n\r\nNote that binding arguments doesn't do a string replacement. The prepared statement is parsed (and compiled, at least in part) on its own, and it knows that it encountered two `?` marks, meaning that two parameters are required. The key point is that the `?` represent parameters, and thus cannot be broken out of — there is no escaping when you bind the parameters, because the engine knows to treat them as string values, not as SQL code. Since the `?` placeholders cannot represent code, it's impossible to inject any SQL in them."}}
{"actor":{"display_login":"aaaaaa123456789"}}