[libdbi-users] libdbi and SQL Injection

[Rick R. <spl...@gm...>]

I am new to both DBs and this library. I am attempting to save a string and
insert it into my MYSQL DB.

An example of the data being read into the db is here:

The name is Krolps, and title is everything after it:
Krolps %s Saints going down tonight!!!!!

The title entry in the MYSQL DB is turned into
name, title



Here is my small program below:
void
website_pfile_phase_one (struct char_data *ch)
{
  dbi_conn conn;
  dbi_result result;
  dbi_inst instance;

  dbi_initialize_r (NULL, &instance);
  conn = dbi_conn_new_r ("mysql", instance);

  dbi_conn_set_option (conn, "host", "box");
  dbi_conn_set_option (conn, "username", "username");
  dbi_conn_set_option (conn, "password", "password");
  dbi_conn_set_option (conn, "dbname", "dnbname");
  dbi_conn_set_option (conn, "encoding", "UTF-8");

  if (dbi_conn_connect (conn) < 0)
    {
      puts ("Could not connect. Please check the option settings\n");
    }
  else
    {
      char sql_string[MAX_STRING_LENGTH], sql_columns[MAX_STRING_LENGTH];

 sprintf (sql_columns,
               "name, title");
      sprintf (sql_string,
               "REPLACE into data (%s) VALUES (\"%s\", \"%s\")",
               sql_columns, GET_NAME (ch), ch->player.title ?
ch->player.title : "None") );

      result = dbi_conn_queryf (conn, sql_string);

      if (result)
        {
          puts ("SUCCESS Website Data");
        }
      dbi_result_free (result);
    }
  dbi_conn_close (conn);
  puts ("END of website data");
  dbi_shutdown_r (instance);
}

Any suggestions on what I am doing wrong? My guess is I need to chanfge
dbi_conn_queryf to something else?

I subscribed today so I may not get any responses, if you could reply to my
address also, it would be appreciated!
spl...@gm...

Thanks for any help or suggestions,
Rj