Re: Re: Sort Order Description
| From: | Bruno Ferreira | Date: | Fri, 12 Mar 2004 01:23:36 +0000 |
| Subject: | Re: Re: Sort Order Description | ||
| References: | 1 2 3 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-33410@lists.php.net to get a copy of this message | ||
kc68@cornell.edu wrote:
[snip...] The following is at the beginning of the script: # get sort order (if any) passed to script $sort_field = $_REQUEST['sort_field']; if (! $sort_field) {$sort_field = "(ssa1202.total/vapall.vapall)*100";} $sort_order = $_REQUEST['sort_order']; if (! $sort_order) {$sort_order = "desc";}First things first. That code (it seems to me) is vulnerable to SQL injection. Better fix that first... Bruno Ferreira --- [This E-mail scanned for viruses by Declude Virus]