Reply to thread

Message

<blockquote data-quote="joz" data-source="post: 504027" data-attributes="member: 70244">Hi ,<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite8" alt=":D" title="Big Grin&nbsp; &nbsp; :D" loading="lazy" data-shortname=":D" /> for the new version but I'm sorry to report that there's still some stuff not being escaped properly. Now it's a query that fails and therefore makes mp crash.As a webdev myself I always escape ALL user input. I think that's a good best practice. What if someone names their files &quot;DROP TABLE Videos &quot; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite1" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> ?[CODE]2009-09-02 11:14:07.265625 [ERROR][MPMain]: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:table Videos already exists query:CREATE TABLE Videos (id integer PRIMARY KEY AUTOINCREMENT, artistID integer, path char(300), title char(100), playCount integer, rating integer, year integer, thumb char(300))2009-09-02 11:14:45.562500 [ERROR][MPMain]: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:near &quot;s&quot;: syntax error query:UPDATE Videos SET playCount = 1 WHERE path = '\\Server\D - Media\Mijn video's\Music Video's\Balthazar - Bathroom Lovin.mp4'2009-09-02 11:14:45.578125 [ERROR][MPMain]: OnMessage exception:SQLite.NET.SQLiteException: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:near &quot;s&quot;: syntax error query:UPDATE Videos SET playCount = 1 WHERE path = '\\Server\D - Media\Mijn video's\Music Video's\Balthazar - Bathroom Lovin.mp4'&nbsp;&nbsp; bij SQLite.NET.SQLiteClient.ThrowError(String statement, String sqlQuery, SqliteError err)&nbsp;&nbsp; bij SQLite.NET.SQLiteClient.Execute(String query)&nbsp;&nbsp; bij MPMusicVids.Data.DataManager.play(String filename)&nbsp;&nbsp; bij MPMusicVids.MusicVidsMain.g_Player_PlayBackStarted(MediaType type, String filename)&nbsp;&nbsp; bij MediaPortal.Player.g_Player.StartedHandler.Invoke(MediaType type, String filename)&nbsp;&nbsp; bij MediaPortal.Player.g_Player.OnStarted()&nbsp;&nbsp; bij MediaPortal.Player.g_Player.Play(String strFile, MediaType type)&nbsp;&nbsp; bij MediaPortal.Playlists.PlayListPlayer.FakePlayer.MediaPortal.Playlists.PlayListPlayer.IPlayer.Play(String strFile)&nbsp;&nbsp; bij MediaPortal.Playlists.PlayListPlayer.Play(Int32 iSong)&nbsp;&nbsp; bij MPMusicVids.MusicVidsMain.playRandomAll()&nbsp;&nbsp; bij MPMusicVids.MusicVidsMain.OnClicked(Int32 controlId, GUIControl control, ActionType actionType)&nbsp;&nbsp; bij MediaPortal.GUI.Library.GUIWindow.OnMessage(GUIMessage message)[/CODE]So the new version did fix the scanner but not the playback part yet. Besides that the scanner came with an ERROR, as a artist suggestion. Not sure which files those were, will report back when I find out.</blockquote>

[QUOTE="joz, post: 504027, member: 70244"] Hi , :thx: for the new version but I'm sorry to report that there's still some stuff not being escaped properly. Now it's a query that fails and therefore makes mp crash. As a webdev myself I always escape ALL user input. I think that's a good best practice. What if someone names their files "DROP TABLE Videos " :) ? [CODE]2009-09-02 11:14:07.265625 [ERROR][MPMain]: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:table Videos already exists query:CREATE TABLE Videos (id integer PRIMARY KEY AUTOINCREMENT, artistID integer, path char(300), title char(100), playCount integer, rating integer, year integer, thumb char(300)) 2009-09-02 11:14:45.562500 [ERROR][MPMain]: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:near "s": syntax error query:UPDATE Videos SET playCount = 1 WHERE path = '\\Server\D - Media\Mijn video's\Music Video's\Balthazar - Bathroom Lovin.mp4' 2009-09-02 11:14:45.578125 [ERROR][MPMain]: OnMessage exception:SQLite.NET.SQLiteException: SQLiteClient: MusicVids.db3 cmd:sqlite3_prepare16:pvm=null err:ERROR detailed:near "s": syntax error query:UPDATE Videos SET playCount = 1 WHERE path = '\\Server\D - Media\Mijn video's\Music Video's\Balthazar - Bathroom Lovin.mp4' bij SQLite.NET.SQLiteClient.ThrowError(String statement, String sqlQuery, SqliteError err) bij SQLite.NET.SQLiteClient.Execute(String query) bij MPMusicVids.Data.DataManager.play(String filename) bij MPMusicVids.MusicVidsMain.g_Player_PlayBackStarted(MediaType type, String filename) bij MediaPortal.Player.g_Player.StartedHandler.Invoke(MediaType type, String filename) bij MediaPortal.Player.g_Player.OnStarted() bij MediaPortal.Player.g_Player.Play(String strFile, MediaType type) bij MediaPortal.Playlists.PlayListPlayer.FakePlayer.MediaPortal.Playlists.PlayListPlayer.IPlayer.Play(String strFile) bij MediaPortal.Playlists.PlayListPlayer.Play(Int32 iSong) bij MPMusicVids.MusicVidsMain.playRandomAll() bij MPMusicVids.MusicVidsMain.OnClicked(Int32 controlId, GUIControl control, ActionType actionType) bij MediaPortal.GUI.Library.GUIWindow.OnMessage(GUIMessage message)[/CODE] So the new version did fix the scanner but not the playback part yet. Besides that the scanner came with an ERROR, as a artist suggestion. Not sure which files those were, will report back when I find out. [/QUOTE]

Verification