From 01e8597f07c30bbfa7071146b1d9e6bead33bebf Mon Sep 17 00:00:00 2001
From: R0adRa93 <42512379+r0adra93@users.noreply.github.com>
Date: Wed, 18 Jan 2023 12:53:38 -0500
Subject: [PATCH] [FIX] Security match sql (#925)

* Added PrepForSQL function

performs a check to a string with expected patterns to be matched.

* Bug Fixes

After talking with Stan I realized that it wasn't testing strings so I set it up to ensure data is a string.

I also reworded the event log.
---
 server/functions.lua | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/functions.lua b/server/functions.lua
index 7df5403..54218f0 100644
--- a/server/functions.lua
+++ b/server/functions.lua
@@ -417,11 +417,12 @@ end
 
 --- SQL Pattern Matching
 function QBCore.Functions.PrepForSQL(source,data,pattern)
+    data = tostring(data)
     local src = source
     local player = QBCore.Functions.GetPlayer(src)
     local result = string.match(data, pattern)
     if not result or string.len(result) ~= string.len(data)  then
-        TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Injection Attempted', 'red', string.format('%s Attempted a SQL Exploit!', player.PlayerData.license))
+        TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Exploit Attempted', 'red', string.format('%s attempted to exploit SQL!', player.PlayerData.license))
         return false
     end
     return true