Public Function Cleanse(Dirty As String) As String
'****************************************************************
'* WHEN        WHO        WHAT
'* ----        ---        ----
'* 11/15/2003  Shannara   Created Function
'****************************************************************

'THIS FUNCTION WILL ESCAPE ALL SINGLE QUOTE CHARACTERS IN AN EFFORT
'TO PREVENT SQL INJECTION ATTACKS. IT IS RECCOMENDED THAT ALL TAINTED DATA BE
'PASSED THROUGH THIS FUNCTION PRIOR TO BEING USED IN DYNAMIC SQL QUERIES.
'
'*******************************************
'NOTE: YOUR BROWSER MAY SHOW SPACES IN THE STRINGS (I.E.  " '  " ) THERE SHOULD BE NO WHITESPACES IN ANY OF THE STRINGS
'*******************************************
'
'WRITTEN BY: MIKE HILLYER
'LAST MODIFIED: 14JUN2003
    Cleanse = Replace(Dirty, "'", "\'")
'CLEVER HACKERS COULD PASS \' TO THIS FUNCTION, WHICH WOULD BECOME \\'
' \\' GETS INTERPRETED AS \', WITH THE \ BEING IGNORED AND THE ' GETTING
'INTERPRETED, THUS BYPASSING THIS FUNCTION, SO WE SHALL LOOP UNTIL WE ARE LEFT
'WITH JUST \' WHICH ESCAPES THE QUOTE, LOOP IS NEEDED BECAUSE A HACKER COULD TYPE
' \\\' IF WE SIMPLY CHECKED FOR \\' AFTER DOING THE INITIAL REPLACE.
    Do While InStr(Cleanse, "\\'")
        Cleanse = Replace(Cleanse, "\\'", "\'")
    Loop
End Function

Public Sub SaveNpc(ByVal NpcNum As Long)
Dim FileName As String
Dim NPCName As String * 20
Dim NPCSay As String * 100
Dim NPCSprite As Integer
Dim NPCSpawnSecs As Long
Dim NPCBehavior As Byte
Dim NPCRange As Integer
Dim NPCDropChance As Integer
Dim NPCDropItem As Byte
Dim NPCDropItemValue As Integer
Dim NPCStat(1 To Stats.Stat_Count - 1) As Byte
Dim NewData As String
Dim CharOne As String
Dim CharTwo As String
Dim F As Long
Dim a As Long

CharOne = Chr(1)
CharTwo = Chr(2)

    If MySQLEnable = True Then
        NewData = NewData & Trim$(Npc(NpcNum).Name) & CharSplit
        NewData = NewData & Trim$(Npc(NpcNum).AttackSay) & CharSplit
        NewData = NewData & Npc(NpcNum).Sprite & CharSplit
        NewData = NewData & Npc(NpcNum).SpawnSecs & CharSplit
        NewData = NewData & Npc(NpcNum).Behavior & CharSplit
        NewData = NewData & Npc(NpcNum).Range & CharSplit
        NewData = NewData & Npc(NpcNum).DropChance & CharSplit
        NewData = NewData & Npc(NpcNum).DropItem & CharSplit
        NewData = NewData & Npc(NpcNum).DropItemValue & CharSplit
        NewData = NewData & CharOne
        NPCName = Trim$(Npc(NpcNum).Name)
        NPCSay = Trim$(Npc(NpcNum).AttackSay)
        NPCSprite = Npc(NpcNum).Sprite
        NPCSpawnSecs = Npc(NpcNum).SpawnSecs
        NPCBehavior = Npc(NpcNum).Behavior
        NPCRange = Npc(NpcNum).Range
        NPCDropChance = Npc(NpcNum).DropChance
        NPCDropItem = Npc(NpcNum).DropItem
        NPCDropItemValue = Npc(NpcNum).DropItemValue
        For a = 1 To (Stats.Stat_Count - 1)
            NPCStat(a) = Npc(NpcNum).Stat(a)
            NewData = NewData & Npc(NpcNum).Stat(a) & CharSplit
        Next a
        NewData = NewData & CharOne
        If MySQLExists("SELECT id FROM Npcs WHERE id = '" & NpcNum & "'") = False Then
            MySQLCreate ("INSERT INTO Npcs (id, Data, Name, Say, Sprite, SpawnSecs, Behavior, Range, DropChance, DropItem, DropItemValue, Stat(1), Stat(2), Stat(3), Stat(4)) VALUES ('" & NpcNum & "', '" & NewData & "', '" & NPCName & "', '" & NPCSay & "', '" & NPCSprite & "', '" & NPCSpawnSecs & "', '" & NPCBehavior & "', '" & NPCRange & "', '" & NPCDropChance & "', '" & NPCDropItem & "', '" & NPCDropItemValue & "', '" & NPCStat(1) & "', '" & NPCStat(2) & "', '" & NPCStat(3) & "', '" & NPCStat(4) & "')")
        Else
            'MsgBox NewData
            'MsgBox NPCRange & vbCrLf & Npc(NpcNum).Range
            MySQLWrite ("UPDATE Npcs SET Data = '" & NewData & "', Name = '" & NPCName & "', Say = '" & NPCSay & "', Sprite = '" & NPCSprite & "', SpawnSecs = '" & NPCSpawnSecs & "', Behavior = '" & NPCBehavior & "' WHERE id = '" & NpcNum & "'")
            MySQLWrite ("UPDATE Npcs SET Range = '" & NPCRange & "', DropChance = '" & NPCDropChance & "', DropItem = '" & NPCDropItem & "', DropItemValue = '" & NPCDropItemValue & "', Stat1 = '" & NPCStat(1) & "', Stat2 = '" & NPCStat(2) & "', Stat3 = '" & NPCStat(3) & "', Stat4 = '" & NPCStat(4) & "' WHERE id = '" & NpcNum & "'")
        End If
    Else
        FileName = App.Path & "\Data\npcs\npc" & NpcNum & ".dat"
        F = FreeFile
   
        Open FileName For Binary As #F
            Put #F, , Npc(NpcNum)
        Close #F
    End If
End Sub

CREATE TABLE IF NOT EXISTS `npcs` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `Data` text NOT NULL,
  `Name` text(20) NOT NULL,
  `Say` text(100) NOT NULL,
  `Sprite` smallint(6) signed NOT NULL,
  `SpawnSecs` int(11) signed NOT NULL,
  `Behavior` tinyint(3) signed NOT NULL,
  `Range` tinyint(3) signed NOT NULL,
  `DropChance` smallint(6) signed NOT NULL,
  `DropItem` tinyint(3) signed NOT NULL,
  `DropItemValue` smallint(6) signed NOT NULL,
  `Stat(1)` tinyint(3) signed NOT NULL,
  `Stat(2)` tinyint(3) signed NOT NULL,
  `Stat(3)` tinyint(3) signed NOT NULL,
  `Stat(4)` tinyint(3) signed NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=latin1;