Threaded Mode | Linear Mode

Rattlehead · 09-17-2013 05:10 PM

this is a simple, easy to use script that will insert account info as players make them on an OPEN ACCOUNT setting in your ini, so there is no need to register on a website, they make their account at the game screen same.

pay attention to the MD5 part of the account setup, i am using the MySQL's hashing function, and there are alot more, and better, hashing functions available to you to use in MySQL, so keep that in mind.

also pay attention to my use of STRMATCH to look for bad words in the queries, i do this so would be scripting hackers dont try to inject ur database through the game somehow, its always best to sanitize user input, even in game.

first u need to set up a table in MySQL, the one i used:

Code:

name: acc_info

fields:

id     int(11)    

username varchar(40) Unique Index     

pword     varchar(40)         

firstip     varchar(16)         

lastip     varchar(16)         

plevel     int(11)        

email     varchar(254)         // per RanXerox - varchar(254)

dpoints     int(11)            

vpoints     int(11)

be sure you have the correct username and password in your ini file for your MySQL database, otherwise this will all be useless

the below function can be found in sphere_serv_triggers.scp:

Code:

[FUNCTION f_onaccount_login]

// add this to the function

if ((STRMATCH(*insert*, <ARGS>)) || (STRMATCH(*select*, <ARGS>)) || (STRMATCH(*update*, <ARGS>)) || (STRMATCH(*execute*, <ARGS>)) || (STRMATCH(*delete*, <ARGS>)) || (STRMATCH(*drop*, <ARGS>)))

   // first we make sure they arent trying to inject us 

   return 1 // if so, they dont need to log in

   serv.log Use of special MySQL word detected  // log the attempt

else // otherwise, lets input their account

   db.connect

   db.query SELECT username FROM acc_info WHERE username LIKE '<ARGS>'

      if <db.row.numrows> == 0

         db.execute INSERT INTO acc_info VALUES('','<ARGS>',md5('<serv.account.<ARGS>.PASSWORD>'),'<serv.account.<ARGS>.lastip>','<serv.account.<ARGS>.lastip>','<serv.account.<ARGS>.plevel>',NULL,'0','0')

      else

   db.execute UPDATE acc_info SET lastip = '<serv.account.<ARGS>.lastip>' WHERE username LIKE '<ARGS>'

   endif

   db.close

endif

below is an event to be placed on all players thru your ini file (it can go on any events, however it must be a global events on all players.)

Code:

[EVENTS e_allplayers]

on=@login

//----------------------------

// check for registered email 

//----------------------------

db.connect

db.query SELECT email FROM acc_info WHERE username LIKE '<account.name>'

if (<isempty <db.row.0.email>>)

dialog d_addemail

endif

db.close

below is the dialog that is called for the email request (the display can be changed, the function for the button must stay the same):

Code:

[DIALOG d_addemail]

50,50

NOCLOSE

NOMOVE

NODISPOSE

page 0

resizepic 63 55 9200 397 158

resizepic 68 62 3500 388 119

dtext 112 76 0 Enter An Email Address To Attach To This Account

dtext 139 93 0 So That You Can Use Website Functions

button 342 183 5204 5205 1 0 1

dtext 94 124 2484 this email will not be used for any purposes other than

dtext 126 140 2484 to send account information and validation

resizepic 91 179 2620 232 33

dtextentry 98 186 221 19 99 0 Enter Your Email Address

[DIALOG d_addemail button]

ON=0 

ON=1

if ((STRMATCH(*insert*, <ARGTXT[0]>)) || (STRMATCH(*select*, <ARGTXT[0]>)) || (STRMATCH(*update*, <ARGTXT[0]>)) || (STRMATCH(*execute*, <ARGTXT[0]>)) || (STRMATCH(*delete*, <ARGTXT[0]>)) || (STRMATCH(*drop*, <ARGTXT[0]>)))

   // first we make sure they arent trying to inject us 

   return 1 // if so, they dont need to add an email

   serv.log Use of special MySQL word detected  // log the attempt

else // otherwise, lets input their email

   db.connect

   db.execute UPDATE acc_info SET email = '<ARGTXT[0]>' WHERE username LIKE '<src.account.name>'

   db.close

endif

if u guys find any bugs, or by all means make it smaller and/or easier, or better in any way, feel free to post and let me know.

**Mordaunt** · 09-17-2013 08:36 PM

Switched it from a php box to a code box to get ride of the side scroll...

babazar · 09-17-2013 09:07 PM

great script well done Big Grin

Rattlehead · 09-18-2013 07:59 AM

i plan to clean this up a bit, streamline some code and make it a one page script with simple installation instructions soon, just waiting to see if any of the vets here maybe have some suggestions for it b4 i get too involved

***XuN*** · 09-18-2013 08:41 AM

Well, I don't know you, but I prefer a CMS with hundreds of security fixes on back than creating my web from 0, so I like more the idea of a bridge betweeen the CMS and sphere creating a field 'sphere_status' on accounts table for sphere (0=just created on web, 1 = already created on sphere), and in every web status update (1 min for me) check for sphere_status '0' to create this account, or if created by client login... send the Insert to web DB.

Other than that, and for other meanings, this can be very usefull Smile

Rattlehead · 09-18-2013 08:48 AM

yeah, i dont perfer CMS, as they tend to fail to meet my exact needs i end up going in and altering the code anyway, and usually by the time i am done i am basically using just the image framework, so may as well just build my own, that way i know 100% that its secure and since i wrote the code much easier to implement and edit things as well. plus most CMS systems look like CMS systems, and to a percentage of players this looks lazy and novice, and it tends to draw ppl away instead of bring them in.

this is more of a framework for a login page on the website which will reflect the actual login to the game, and vice versa, it could technically be used by a CMS with little alteration.

RanXerox · 09-18-2013 09:05 AM

You should maybe allocate 254 characters per email address, which is currently the maximum valid email address length.

~~amonvangrell~~ · 09-19-2013 07:14 AM

resuming: I don't understand .00000001% of what you guys have said.... lol

Threaded Mode \| Linear Mode Account info to MySQL
Author	Message