Properly escape IP in sessions table insert query - #4977
Merged
Conversation
Fixed the INSERT statement into the sessions table by properly escaping the IP address passed to INET6_ATON, avoiding SQL syntax errors. Previously, the IP was inserted without quotes, causing the query to fail. Now, the IP is correctly wrapped in quotes and escaped using db.escapeString, ensuring compatibility with both IPv4 and IPv6 connections in the database.
Contributor
|
Aren't we getting rid of the sessions anyways with this PR? #4967 |
Contributor
Author
I hope so I can't fix the "Malformed session key" error, I tried fixing the session db, changing useSessionKey in config.lua, nothing works. :/ |
ArturKnopik
approved these changes
Oct 5, 2025
ArturKnopik
left a comment
ArturKnopik
left a comment
Contributor
There was a problem hiding this comment.
LGTM, tested, no issues with login
Contributor
Author
Have you tested with OTLand Client? |
Contributor
Tested with cipsoft client. |
Contributor
Author
|
In short https://otland.net/forums/otclient.494/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Prelude
Changes Proposed
This PR fixes a syntax error when inserting into the
sessionstable by correctly quoting and escaping the IP address passed toINET6_ATON. Previously, the IP string was concatenated directly, which could result in malformed SQL queries or potential security issues.Changes:
connection->getIP().to_string()in single quotes.db.escapeString()before formatting into the SQL query.Why it matters:
Ensures correct SQL syntax and prevents connection errors when creating session entries, particularly with IPv6 addresses.
Issues addressed: From TFS Console "[Error - mysql_real_query] Query: INSERT INTO sessions (token, account_id, ip) VALUES ('1z�i���L����Lm&', 1, INET6_ATON(::ffff:127.0.0.1))
Message: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '::ffff:127.0.0.1))' at line 1"
How to test: