FODASSE QUE BORRAÇO

app/api/events/register/route.ts

@@ -9,6 +9,8 @@ export async function POST(request: Request) {
     const body = await request.json();
     const { eventId, steamId, carModel, carSkin, teamName } = body;
 
+    console.log('Received registration data:', body);
+
     // Validate required fields
     if (!eventId || !steamId || !carModel) {
       return NextResponse.json(
@@ -17,8 +19,18 @@ export async function POST(request: Request) {
       );
     }
 
-    // Convert steamId to number (BIGINT)
-    const driverGuid = parseInt(steamId);
+    // Validate steamId format to prevent SQL injection
+    const steamId = inputSteamId.trim(); // just in case
+
+    if (!/^[0-9]{15,20}$/.test(steamId)) {
+      return NextResponse.json(
+        { success: false, error: "Invalid Steam ID format" },
+        { status: 400 }
+      );
+    } 
+
+    const driverGuid = steamId;
+    console.log('Parsed driver GUID:', driverGuid);
     if (isNaN(driverGuid)) {
       return NextResponse.json(
         { success: false, error: 'Invalid Steam ID format' },
@@ -28,7 +40,7 @@ export async function POST(request: Request) {
 
     // Check if user exists in database
     const userCheck = await queryOne(
-      'SELECT driver_guid FROM users WHERE driver_guid = $1',
+      'SELECT driver_guid FROM users WHERE driver_guid = $1;',
       [driverGuid]
     );