notnull/banned
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix for secure SQL operations.

Browse Source 
Removed Python string operations from SQL operations.
This commit is contained in:
Yizhe Shen 2014-02-09 23:35:33 -05:00
parent 829fd260e2
commit 8b235580a2
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
settings/wolfgame.py
View File

@ -287,7 +287,7 @@ def update_game_stats(size, vwon, wwon):
vwins, wwins, total = 0, 0, 0 vwins, wwins, total = 0, 0, 0
c.execute("SELECT villagewins, wolfwins, totalgames FROM gamestats "+ c.execute("SELECT villagewins, wolfwins, totalgames FROM gamestats "+
"WHERE size = %d" % size) "WHERE size=?", (size,))
row = c.fetchone() row = c.fetchone()
if row: if row:
vwins, wwins, total = row vwins, wwins, total = row
@ -303,14 +303,14 @@ def update_game_stats(size, vwon, wwon):
def get_player_stats(player, role): def get_player_stats(player, role):
with conn: with conn:
for row in c.execute("SELECT * FROM rolestats WHERE player = '%s' AND role = '%s'" % (player, role)): for row in c.execute("SELECT * FROM rolestats WHERE player=? AND role=?", (player, role)):
return "As {2}, {0} has {3} team wins, {4} individual wins, and {5} total games.".format(player, *row) return "As {2}, {0} has {3} team wins, {4} individual wins, and {5} total games.".format(player, *row)
else: else:
return "" return ""
def get_game_stats(size): def get_game_stats(size):
with conn: with conn:
for row in c.execute("SELECT * FROM gamestats WHERE size = %d" % (size)): for row in c.execute("SELECT * FROM gamestats WHERE size=?", (size,)):
return "{0} player games: {1} village wins, {2} wolf wins, and {3} total games.".format(*row) return "{0} player games: {1} village wins, {2} wolf wins, and {3} total games.".format(*row)
else: else:
return "" return ""
@ -319,7 +319,7 @@ def get_game_totals():
sizeList = [] sizeList = []
with conn: with conn:
for size in range(4, MAX_PLAYERS): for size in range(4, MAX_PLAYERS):
c.execute("SELECT size, totalgames FROM gamestats WHERE size = %d" % size) c.execute("SELECT size, totalgames FROM gamestats WHERE size=?", (size,))
row = c.fetchone() row = c.fetchone()
if row: if row:
sizeList.append("{0}p({1})".format(*row)) sizeList.append("{0}p({1})".format(*row))