Looking for recomendations when creating GUI

[ShadoX<~]

Hi guys, I'm realtive new into scripting and as far as I know, I like it alot

Right now I'm working on a simple but useless script that querys a MySQL Database to get a list of serials (random) then using a GUI Window with a gridList the user is able to see the table

I have add a function to only make the system work for Admin Users

It works like this

The client side contains the GUI, when the user wants to open the panel, I added an CommandHandler that goes to a function that verify if the source is an admin, if it is, it triggers an ClientEvent that creates and display the GUI

Then there is a button on the GUI that when it is clicked it triggers an Server Event that querys the Database and Triggers an Client Event to send the table with the information, then just using a for I fill the table of the grid list

My Question

-How secure it is ? can I get Hacked by the way my script is coded?

-Any recomendation of how can I make it better?

 

Thanks!

Here is the code

Client.lua

	--Function to create the GUI
	function createGUI()
		--Create the window
		window = guiCreateWindow(374, 221, 1181, 647, "Script", false)
		guiWindowSetSizable(window, false)
		Grid = guiCreateGridList(12, 52, 257, 408, false, window)
		QueryB = guiCreateButton(12, 465, 257, 37, "QUERY", false, window)
		Colum = guiGridListAddColumn( Grid, "Serial", 1.0 )
		ExitB = guiCreateButton(466, 596, 249, 41, "Exit", false, Window)
  		--Add event handler when the exit button is presed
  		addEventHandler("onClientGUIClick", ExitB, closeGUI, false )
		--Add event handler when the query button is presed
		addEventHandler("onClientGUIClick", QueryB, 
			function()
				triggerServerEvent("sendMeTheData",resourceRoot) --This triggers the server Event that triggers a client event with the table
			end
 		, false )
	end
  
--Function to start the GUI
	function startGUI()
		--Create GUI
		createGUI()
		--If everything is fime then set it to visible
		if (window ~= nil) then
			guiSetVisible(window, true)	
		else
			outputChatBox("error")
		end
		--show cursor
		showCursor(true)
		guiSetInputEnabled(true)
	end
	
--Function to close GUI
	function closeGUI()
		--hide the GUI
		guiSetVisible(Window, false)
		showCursor(false)
		guiSetInputEnabled(false)
	end

--Function to fill the grid list row
	function fillRow(table)
		guiGridListClear(Grid) --clear the grid list
		--using for, fill the grid with the table
		for k, data in ipairs(table) do
			local row = guiGridListAddRow ( Grid )
			guiGridListSetItemText ( Grid, row, Colum, data.serial , false , false ) --add item to row
		end
	end


--Events and Event Handler
addEvent("fillData",true)
addEventHandler("fillData",getRootElement(),fillRow)
addEvent("showGUI",true)
addEventHandler("showGUI",getRootElement(),startGUI)
  

Server.lua

--MySQL data
local host = "x.x.x.x"
local user = "user"
local password = "password"
local database = "database"

--Connect to mysql server
local conexion =  dbConnect( "mysql", "dbname="..database..";host="..host,user,password, "share=1")

--Function to show the GUI
function showPanel(player,cmd)
	--see if the player is admin
	if (isObjectInACLGroup("user." ..getAccountName(getPlayerAccount(player)),aclGetGroup("Admin"))) then
		--trigger client event to open the GUI
		triggerClientEvent(player,"showGUI",player)
	else
		outputChatBox("Sorry, you are not admin!",source)
	end
end
--Function to query mysql database and trigger client function to send table
function getOnlyRow(tipo)
	local query = dbQuery(conexion,"SELECT * FROM log")
	local table = dbPoll(query,-1)
	--Trigger client event to fill grid list
	triggerClientEvent(client,"fillData",client,table)
end

--Event and event handler
addEvent("sendMeTheData",true)
addEventHandler("sendMeTheData",getResourceRootElement(),getTable)
addCommandHandler("panel",showPanel)

 

[IIYAMA]

For every message from client to Server, validate if the user is Admin.

And do not insert things directly in your db string, but let MTA escape them.(mysql injections)

Edited December 18, 2017 by IIYAMA