Index: game/AccountMgr.cpp
===================================================================
--- game/AccountMgr.cpp	(revision 5449)
+++ game/AccountMgr.cpp	(working copy)
@@ -134,7 +134,9 @@
 {
     loginDatabase.escape_string(username);
 
-    QueryResult *result = loginDatabase.PQuery("SELECT id FROM account WHERE UPPER(username)=UPPER('%s')", username.c_str());
+    std::transform( username.begin(), username.end(), username.begin(), ::toupper );
+
+    QueryResult *result = loginDatabase.PQuery("SELECT id FROM account WHERE username = '%s'", username.c_str());
     if(!result)
         return 0;
     else
Index: game/WorldSocket.cpp
===================================================================
--- game/WorldSocket.cpp	(revision 5449)
+++ game/WorldSocket.cpp	(working copy)
@@ -253,11 +253,11 @@
     sLog.outDebug("Auth: client %u, unk2 %u, account %s, clientseed %u", BuiltNumberClient, unk2, account.c_str(), clientSeed);
 
     ///- Get the account information from the realmd database
-    std::string safe_account=account;                       // Duplicate, else will screw the SHA hash verification below
+    std::string safe_account = account;                       // Duplicate, else will screw the SHA hash verification below
     loginDatabase.escape_string(safe_account);
     //No SQL injection, username escaped.
     //                                                 0   1        2           3        4       5              6  7  8    9         10
-    QueryResult *result = loginDatabase.PQuery("SELECT id, gmlevel, sessionkey, last_ip, locked, sha_pass_hash, v, s, tbc, mutetime, locale FROM account WHERE UPPER(username) = '%s'", safe_account.c_str());
+    QueryResult *result = loginDatabase.PQuery("SELECT id, gmlevel, sessionkey, last_ip, locked, sha_pass_hash, v, s, tbc, mutetime, locale FROM account WHERE username = '%s'", safe_account.c_str());
 
     ///- Stop if the account is not found
     if ( !result )
@@ -295,7 +295,7 @@
     const char* sStr = s.AsHexStr();                        //Must be freed by OPENSSL_free()
     const char* vStr = v.AsHexStr();                        //Must be freed by OPENSSL_free()
     sLog.outDebug("SOCKET: (s,v) check s: %s v_old: %s v_new: %s", sStr, fields[6].GetString(), vStr );
-    loginDatabase.PExecute("UPDATE account SET v = '0', s = '0' WHERE UPPER(username) = '%s'", safe_account.c_str());
+    loginDatabase.PExecute("UPDATE account SET v = '0', s = '0' WHERE username = '%s'", safe_account.c_str());
     if ( strcmp(vStr,fields[6].GetString() ) )
     {
         packet.Initialize( SMSG_AUTH_RESPONSE, 1 );
@@ -416,7 +416,7 @@
     //No SQL injection, username escaped.
     std::string address = GetRemoteAddress();
     loginDatabase.escape_string(address);
-    loginDatabase.PExecute("UPDATE account SET last_ip = '%s' WHERE UPPER(username) = '%s'",address.c_str(), safe_account.c_str());
+    loginDatabase.PExecute("UPDATE account SET last_ip = '%s' WHERE username = '%s'",address.c_str(), safe_account.c_str());
 
     // do small delay (10ms) at accepting successful authed connection to prevent droping packets by client
     // don't must harm anyone (let login ~100 accounts in 1 sec ;) )
Index: mangosd/RASocket.cpp
===================================================================
--- mangosd/RASocket.cpp	(revision 5449)
+++ mangosd/RASocket.cpp	(working copy)
@@ -143,11 +143,14 @@
 
                     ///- Get the gmlevel and password from the account table
                     std::string login = szLogin;
+
+                    // No SQL injection (escaped login)
                     loginDatabase.escape_string(login);
-                    // No SQL injection (escaped login)
 
-                    QueryResult* result = loginDatabase.PQuery("SELECT gmlevel FROM account WHERE UPPER(username) = UPPER('%s')",login.c_str());
+                    std::transform( login.begin(), login.end(), login.begin(), ::toupper );
 
+                    QueryResult* result = loginDatabase.PQuery("SELECT gmlevel FROM account WHERE username = '%s'",login.c_str());
+
                     ///- If the user is not found, deny access
                     if(!result)
                     {
@@ -184,7 +187,10 @@
                     std::string pw = &buff[5];
                     loginDatabase.escape_string(login);
                     loginDatabase.escape_string(pw);
-                    QueryResult *check = loginDatabase.PQuery("SELECT 1 FROM account WHERE UPPER(username)=UPPER('%s') AND sha_pass_hash=SHA1(CONCAT(UPPER(username),':',UPPER('%s')))", login.c_str(), pw.c_str());
+
+                    std::transform( login.begin(), login.end(), login.begin(), ::toupper );
+
+                    QueryResult *check = loginDatabase.PQuery("SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash=SHA1(CONCAT(UPPER(username),':',UPPER('%s')))", login.c_str(), pw.c_str());
                     if(check)
                     {
                         delete check;
Index: realmd/AuthSocket.cpp
===================================================================
--- realmd/AuthSocket.cpp	(revision 5449)
+++ realmd/AuthSocket.cpp	(working copy)
@@ -312,7 +312,7 @@
     const char *v_hex, *s_hex;
     v_hex = v.AsHexStr();
     s_hex = s.AsHexStr();
-    dbRealmServer.PExecute("UPDATE account SET v = '%s', s = '%s' WHERE UPPER(username)= UPPER('%s')",v_hex,s_hex, _safelogin.c_str() );
+    dbRealmServer.PExecute("UPDATE account SET v = '%s', s = '%s' WHERE username= '%s'",v_hex,s_hex, _safelogin.c_str() );
     OPENSSL_free((void*)v_hex);
     OPENSSL_free((void*)s_hex);
 }
@@ -385,7 +385,7 @@
             ///- Get the account details from the account table
             // No SQL injection (escaped user name)
 
-            result = dbRealmServer.PQuery("SELECT sha_pass_hash,id,locked,last_ip,gmlevel FROM account WHERE UPPER(username) = '%s'",_safelogin.c_str ());
+            result = dbRealmServer.PQuery("SELECT sha_pass_hash,id,locked,last_ip,gmlevel FROM account WHERE username = '%s'",_safelogin.c_str ());
             if( result )
             {
                 ///- If the IP is 'locked', check that the player comes indeed from the correct IP address
@@ -624,7 +624,7 @@
         ///- Update the sessionkey, last_ip and last login time in the account table for this account
         // No SQL injection (escaped user name) and IP address as received by socket
         const char* K_hex = K.AsHexStr();
-        dbRealmServer.PExecute("UPDATE account SET sessionkey = '%s', last_ip = '%s', last_login = NOW(), locale = '%u' WHERE UPPER(username) = '%s'", K_hex, GetRemoteAddress().c_str(),  _localization, _safelogin.c_str() );
+        dbRealmServer.PExecute("UPDATE account SET sessionkey = '%s', last_ip = '%s', last_login = NOW(), locale = '%u' WHERE username = '%s'", K_hex, GetRemoteAddress().c_str(),  _localization, _safelogin.c_str() );
         OPENSSL_free((void*)K_hex);
 
         ///- Finish SRP6 and send the final result to the client
@@ -664,7 +664,7 @@
     ///- Get the user id (else close the connection)
     // No SQL injection (escaped user name)
 
-    QueryResult *result = dbRealmServer.PQuery("SELECT id,sha_pass_hash FROM account WHERE UPPER(username) = '%s'",_safelogin.c_str());
+    QueryResult *result = dbRealmServer.PQuery("SELECT id,sha_pass_hash FROM account WHERE username = '%s'",_safelogin.c_str());
     if(!result)
     {
         sLog.outError("[ERROR] user %s tried to login and we cannot find him in the database.",_login.c_str());