STRLCPY/DonPAPI

Merge pull request #13 from Hackndo/patch-1

Parameterized queries for adding credentials

Total 1 files

■ ■ ■ ■ ■ ■

database.py

		skipped 1078 lines
1079	1079		#return None
1080	1080		try:
1081	1081		if pillaged_from_userid == None :
1082		-	query = f"SELECT * FROM credz WHERE LOWER(username)=LOWER('{credz_username}') AND LOWER(password)=LOWER('{credz_password}') AND LOWER(type)=LOWER('{credz_type}') AND LOWER(target)=LOWER('{credz_target}') AND pillaged_from_computerid={pillaged_from_computerid}"
	1082	+	query = "SELECT * FROM credz WHERE LOWER(username)=LOWER(:credz_username) AND LOWER(password)=LOWER(:credz_password) AND LOWER(type)=LOWER(:credz_type) AND LOWER(target)=LOWER(:credz_target) AND pillaged_from_computerid=:pillaged_from_computerid"
	1083	+	parameters = {
	1084	+	"credz_username": credz_username,
	1085	+	"credz_password": credz_password,
	1086	+	"credz_type": credz_type, "credz_target": credz_target,
	1087	+	"pillaged_from_computerid": int(pillaged_from_computerid),
	1088	+	}
1083	1089		else:
1084		-	query=f"SELECT * FROM credz WHERE LOWER(username)=LOWER('{credz_username}') AND LOWER(password)=LOWER('{credz_password}') AND LOWER(type)=LOWER('{credz_type}') AND LOWER(target)=LOWER('{credz_target}') AND pillaged_from_computerid={pillaged_from_computerid} AND pillaged_from_userid={pillaged_from_userid}"
	1090	+	query = "SELECT * FROM credz WHERE LOWER(username)=LOWER(:credz_username) AND LOWER(password)=LOWER(:credz_password) AND LOWER(type)=LOWER(:credz_type) AND LOWER(target)=LOWER(:credz_target) AND pillaged_from_computerid=:pillaged_from_computerid AND pillaged_from_userid=:pillaged_from_userid"
	1091	+	parameters = {
	1092	+	"credz_username": credz_username,
	1093	+	"credz_password": credz_password,
	1094	+	"credz_type": credz_type, "credz_target": credz_target,
	1095	+	"pillaged_from_computerid": int(pillaged_from_computerid),
	1096	+	"pillaged_from_userid": int(pillaged_from_userid)
	1097	+	}
1085	1098		self.logging.debug(query)
1086	1099		with self.conn:
1087	1100		cur = self.conn.cursor()
1088		-	cur.execute(query)
	1101	+	cur.execute(query, parameters)
1089	1102		results = cur.fetchall()
1090	1103		except Exception as ex:
1091	1104		self.logging.error(f"Exception in add_credz 3")
		skipped 1 lines
1093	1106		try:
1094	1107		if not len(results):
1095	1108		if pillaged_from_userid == None:
1096		-	query = f"INSERT INTO credz (username, password, target, type, pillaged_from_computerid, file_path) VALUES ('{credz_username}', '{credz_password}', '{credz_target}', '{credz_type}', {pillaged_from_computerid}, '{credz_path}')"
	1109	+	query = "INSERT INTO credz (username, password, target, type, pillaged_from_computerid, file_path) VALUES (:credz_username, :credz_password, :credz_target, :credz_type, :pillaged_from_computerid, :credz_path)"
	1110	+	parameters = {
	1111	+	"credz_username": credz_username,
	1112	+	"credz_password": credz_password,
	1113	+	"credz_target": credz_target,
	1114	+	"credz_type": credz_type,
	1115	+	"pillaged_from_computerid": int(pillaged_from_computerid),
	1116	+	"credz_path": credz_path,
	1117	+	}
1097	1118		else:
1098		-	query=f"INSERT INTO credz (username, password, target, type, pillaged_from_computerid,pillaged_from_userid, file_path) VALUES ('{credz_username}', '{credz_password}', '{credz_target}', '{credz_type}', {pillaged_from_computerid}, {pillaged_from_userid}, '{credz_path}')"
	1119	+	query = "INSERT INTO credz (username, password, target, type, pillaged_from_computerid,pillaged_from_userid, file_path) VALUES (:credz_username, :credz_password, :credz_target, :credz_type, :pillaged_from_computerid, :pillaged_from_userid, :credz_path)"
	1120	+	parameters = {
	1121	+	"credz_username": credz_username,
	1122	+	"credz_password": credz_password,
	1123	+	"credz_type": credz_type,
	1124	+	"credz_target": credz_target,
	1125	+	"pillaged_from_computerid": int(pillaged_from_computerid),
	1126	+	"pillaged_from_userid": int(pillaged_from_userid),
	1127	+	"credz_path": credz_path,
	1128	+	}
1099	1129		self.logging.debug(query)
1100	1130		with self.conn:
1101	1131		cur = self.conn.cursor()
1102		-	cur.execute(query)
	1132	+	cur.execute(query, parameters)
1103	1133		user_rowid = cur.lastrowid
1104	1134		self.logging.debug(
1105	1135		f'added_credential(credtype={credz_type}, target={credz_target}, username={credz_username}, password={credz_password}) => {user_rowid}')
		skipped 297 lines