2 files changed, 38 insertions, 16 deletions

diff --git a/OpenSim/Data/MySQL/MySQLManager.cs b/OpenSim/Data/MySQL/MySQLManager.cs
index 15bdf44..e863216 100644
--- a/OpenSim/Data/MySQL/MySQLManager.cs
+++ b/OpenSim/Data/MySQL/MySQLManager.cs
@@ -280,6 +280,19 @@ namespace OpenSim.Data.MySQL
             cmd.ExecuteNonQuery();
         }
 
+        public void ExecuteParameterizedSql(string sql, Dictionary<string, string> parameters)
+        {
+            CheckConnection();
+
+            MySqlCommand cmd = (MySqlCommand)dbcon.CreateCommand();
+            cmd.CommandText = sql;
+            foreach (KeyValuePair<string, string> param in parameters)
+            {
+                cmd.Parameters.AddWithValue(param.Key, param.Value);
+            }
+            cmd.ExecuteNonQuery();
+        }
+
         /// <summary>
         /// Given a list of tables, return the version of the tables, as seen in the database
         /// </summary>
diff --git a/OpenSim/Data/MySQL/MySQLUserData.cs b/OpenSim/Data/MySQL/MySQLUserData.cs
index 7a44d3c..8d0b177 100644
--- a/OpenSim/Data/MySQL/MySQLUserData.cs
+++ b/OpenSim/Data/MySQL/MySQLUserData.cs
@@ -62,6 +62,7 @@ namespace OpenSim.Data.MySQL
         private string m_usersTableName;
         private string m_userFriendsTableName;
         private string m_appearanceTableName = "avatarappearance";
+        private string m_attachmentsTableName = "avatarattachments";
         private string m_connectString;
 
         public override void Initialise()
@@ -542,12 +543,10 @@ namespace OpenSim.Data.MySQL
 
             try
             {
-                IDbCommand updater =
-                    dbm.Manager.Query(
+               dbm.Manager.ExecuteParameterizedSql(
                         "update " + m_usersTableName + " SET webLoginKey = ?webLoginKey " +
                         "where UUID = ?UUID",
                         param);
-                updater.ExecuteNonQuery();
             }
             catch (Exception e)
             {
@@ -788,19 +787,27 @@ namespace OpenSim.Data.MySQL
         {
             MySQLSuperManager dbm = GetLockedConnection();
 
+            Dictionary<string, string> param = new Dictionary<string, string>();
+            param["?uuid"] = agentID.ToString();
+
             try
             {
-                MySqlCommand cmd = dbm.Manager.Connection.CreateCommand();
-                cmd.CommandText = "select attachpoint, item, asset from avatarattachments where UUID = ?uuid";
-                cmd.Parameters.AddWithValue("?uuid", agentID.ToString());
-
-                IDataReader r = cmd.ExecuteReader();
+                IDbCommand result = dbm.Manager.Query(
+                    "SELECT attachpoint, item, asset from " + m_attachmentsTableName + " WHERE UUID = ?uuid", param);
+                IDataReader reader = result.ExecuteReader();
 
-                Hashtable ret = dbm.Manager.readAttachments(r);
+                Hashtable ret = dbm.Manager.readAttachments(reader);
 
-                r.Close();
+                reader.Dispose();
+                result.Dispose();
                 return ret;
             }
+            catch (Exception e)
+            {
+                dbm.Manager.Reconnect();
+                m_log.Error(e.ToString());
+                return null;
+            }
             finally
             {
                 dbm.Release();
@@ -823,14 +830,16 @@ namespace OpenSim.Data.MySQL
         public override void ResetAttachments(LLUUID userID)
         {
             MySQLSuperManager dbm = GetLockedConnection();
+
+            Dictionary<string, string> param = new Dictionary<string, string>();
+            param["?uuid"] = userID.ToString();
+
             try
             {
-                MySqlCommand cmd = dbm.Manager.Connection.CreateCommand();
-                cmd.CommandText =
-                    "update avatarattachments set asset = '00000000-0000-0000-0000-000000000000' where UUID = ?uuid";
-                cmd.Parameters.AddWithValue("?uuid", userID.ToString());
-
-                cmd.ExecuteNonQuery();
+                dbm.Manager.ExecuteParameterizedSql(
+                    "UPDATE " + m_attachmentsTableName + 
+                    " SET asset = '00000000-0000-0000-0000-000000000000' WHERE UUID = ?uuid",
+                    param);
             }
             finally
             {