Re: extract($_POST)
| From: | @ Edwin | Date: | Fri, 25 Oct 2002 21:17:08 +0000 |
| Subject: | Re: extract($_POST) | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-121481@lists.php.net to get a copy of this message | ||
Hello,
"Rick Emery" <remery@emeryloftus.com> wrote:
> Lets say you have a statement like:
> $query = "SELECT * FROM mytable WHERE firstname=$firstname";
>
> And if $firstname is set to:
> "xyz"; DELETE FROM mytable
>
> Then this is executed as: SELECT* FROM mytable WHERE
firstname="xyz";DELETE FROM mytable
>
> This can wipe out your table...a bad thing...
Well, one way you can avoid similar things to happen is, you can do
something like, say, create a user that can only SELECT. If the user can
only SELECT then it cannot DELETE.
- E
...[snip]...