MySQL error

Error:

Code:

176.106.72.146:54650/76561198109715475/PokerF@ce joined [windows/0]
11:08 AM [Error] MySql handle raised an exception (ArgumentException: Parameter '@ce' specified but none of the passed arguments have a property with this name
(in 'INSERT INTO `db_users`
(`serverid`,`steam_id`,`username`,`flags`,`lvl`,`last_connect_date`,`first_connect_date`,`last_connect_ip`,`first_connect_ip`)
VALUES ('1','76561198109715475','PokerF@ce','online,default','15',NOW(),NOW(),'176.106.72.146','176.106.72.146');'))11:08 AM [Debug]   at Oxide.Core.Database.Sql+<ProcessParams>c__AnonStorey0.<>m__0 (System.Text.RegularExpressions.Match m) [0x00000] in <filename unknown>:0
  at System.Text.RegularExpressions.Regex+Adapter.Evaluate (System.Text.RegularExpressions.Match m, System.Text.StringBuilder sb) [0x00000] in <filename unknown>:0
  at System.Text.RegularExpressions.BaseMachine.LTRReplace (System.Text.RegularExpressions.Regex regex, System.String input, System.Text.RegularExpressions.MatchAppendEvaluator evaluator, Int32 count, Int32 startat, Boolean needs_groups_or_captures) [0x00000] in <filename unknown>:0
  at System.Text.RegularExpressions.BaseMachine.LTRReplace (System.Text.RegularExpressions.Regex regex, System.String input, System.Text.RegularExpressions.MatchAppendEvaluator evaluator, Int32 count, Int32 startat) [0x00000] in <filename unknown>:0
  at System.Text.RegularExpressions.Regex.Replace (System.String input, System.Text.RegularExpressions.MatchEvaluator evaluator, Int32 count, Int32 startat) [0x00000] in <filename unknown>:0
  at System.Text.RegularExpressions.Regex.Replace (System.String input, System.Text.RegularExpressions.MatchEvaluator evaluator) [0x00000] in <filename unknown>:0
  at Oxide.Core.Database.Sql.ProcessParams (System.String sql, System.Object[] argsSrc, System.Collections.Generic.List`1 argsDest) [0x00000] in <filename unknown>:0
  at Oxide.Core.Database.Sql.Build (System.Text.StringBuilder sb, System.Collections.Generic.List`1 args, Oxide.Core.Database.Sql lhs) [0x00000] in <filename unknown>:0
  at Oxide.Core.Database.Sql.Build (System.Text.StringBuilder sb, System.Collections.Generic.List`1 args, Oxide.Core.Database.Sql lhs) [0x00000] in <filename unknown>:0
  at Oxide.Core.Database.Sql.Build () [0x00000] in <filename unknown>:0
  at Oxide.Core.Database.Sql.get_SQL () [0x00000] in <filename unknown>:0
  at Oxide.Ext.MySql.Libraries.MySql+MySqlQuery.Handle () [0x00000] in <filename unknown>:0

Code:

Code:

string sql = @"INSERT INTO `db_users`
(`serverid`,`steam_id`,`username`,`flags`,`lvl`,`last_connect_date`,`first_connect_date`,`last_connect_ip`,`first_connect_ip`)
VALUES ('"+plugin.id+@"','"+player.userID.ToString()+@"','"+MySqlHelper.EscapeString(player.displayName)+@"','"+groups+@"','"+ Convert.ToInt32(player.xp.CurrentLevel) + "',NOW(),NOW(),'"+ip+@"','"+ip+@"');";
Sql srv = ox.Interface.Oxide.GetLibrary<msql.Libraries.MySql>("MySql").NewSql();
srv.Append(sql);
ox.Interface.Oxide.GetLibrary<msql.Libraries.MySql>("MySql").Update(srv, plugin.db);

pls, fix it =(

 

Pass your arguments via placeholders instead of using MySqlHelper.EscapeString, see: Preventing SQL injections | Oxide

 

I love the standard function =( okay, I will build oxide itself