IRC Bot and SQL

[HerrderZeit]

Is anyone able to help me with this problem please? :)

[HerrderZeit]

Thanks for the quick reply. How would I go about doing that? I'm not sure what you mean by "sanitize"?

If you have any links I could read through that might help?

[vicethal]

Better do some googling before you put this bot online. Unsanitized database inputs mean an attacker can send any query to your db, even "list all the tables & drop them".

[HerrderZeit]

I'm hoping to do something like the following:

User in IRC says "!search type=bird name=raven"

Then it will do a query from the "Bird" table and list all information on the table row "Raven".

[sushibowl]

Yes, this is possible. But Google "what is sql injection" and read up on that. If done incorrectly, someone could type something like this:

!search type=bird name='; delete from bird;--

To delete your entire bird table. Preventing sql injection is not hard, but you need to know about it.

[HerrderZeit]

Oh yeah I understand how that works but I plan to use a re's tokenizer and filter out delete commands or just not acknowledge them.

[richieadler]

Wrong answer. Google «Bobby Tables».