MySQL / PHP account management

[Zippy]

This code was originally part of UOGamers: Rebirth (a UOGamers/RunUO shard active in 2005-2006). [Or sometimes known as "the great Zippy code dump of 2011"]

The attached file contains most of the pieces necessary to create a working MySQL account system where the game server and PHP code share a central database for account management. Changes made via the web are available instantly inside the game server.

Features include the ability for users to manage their own IP address mask/filter blocks. Also accounts are created via the web server and confirmed via e-mail before logins are allowed. Also has "forgot password".

How to set up the SQL server: The last time I did this was in 2005. At that time, once could download MyODBC which would allow a "Data Service Name (DSN)" to be set up through the Winodws control pannel which would associate a name (like "runuo-db") with a MySQL server IP address + password + database configuration.

The RunUO Code is not complete. This is the "Accounts" folder portion of the code, which is a semi-drop in replacement. This code will probably need to be modified or extended to support RunUO 2.0+ and some portions of code outside of here (like the Admin Gump) may also need modification. I think some of the things the Admin Gump does with looping through accounts can be extremely slow when those operations hit the database.... and so some of that AdminGump code might need to be refactored or disabled.

The PHP is from a different time in internet security. In all likelihood it does contain some type of SQL injection vulnerability. I don't recommend using this code as-is on a public website/RunUO server. Not only is it old, but it is now publicly viewable and people are sure to find issues with it.

The Way Forward: people have expressed interest in this code, so I am hoping they will improve it and release a working version for the benefit of all. Do not contact me directly about this code, I can't help you. I will try to watch this thread for questions, but I might not. You should consider yourselves on your own in trying to get this working.

(See Also: http://www.runuo.com/community/threads/uogamers-rebirth-complete-server-pre-t2a-era-2-1-svn.485832/ )

 

[Pure Insanity]

Thanks for the release, the php files aren't really going to be of use to me as the site I'm building will use asp. But it'll be nice to have the building blocks to convert the accounts into mysql. In the end, I may just sync the accounts with mysql, so I can keep a full copy of it server side...to avoid the admin gump and stuff taking so long, and to not have to query the database for each result. I'll figure something out as I get to it, again, thanks for the share. =D

 

[Jeff]

Just like to point out this is EXTEMELY vulnerable to SQL Injection, so as Zippy said, don't use it on a public server.

 

[Zippy]

Thanks for the release, the php files aren't really going to be of use to me as the site I'm building will use asp. But it'll be nice to have the building blocks to convert the accounts into mysql. In the end, I may just sync the accounts with mysql, so I can keep a full copy of it server side...to avoid the admin gump and stuff taking so long, and to not have to query the database for each result. I'll figure something out as I get to it, again, thanks for the share. =D

I think you'll find syncing this way harder than you think. The server is not designed to reload accounts from a file regularly and that presents some unique challenges. And most of the functionality you get through the AdminGump involves making changes to account data, which is right out if you're not writing to the DB. Actually, you'd have to keep character serial numbers completely separate since char creation is done by the server.

It's a better idea to keep them perfectly in-sync and make an ASP interface that does the same thing that you would want to use the AdminGump to do. (Stuff that involves iterating over large number of accounts.) Normal operation (ban, comment, char creation) won't be impacted by having to hit the DB directly. And it will keep the server side code simple which is always a good thing.