Re: iCalendar creation not working with Outlook
| From: | Rasmus Lerdorf | Date: | Wed, 06 Jul 2005 23:44:14 +0000 |
| Subject: | Re: iCalendar creation not working with Outlook | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-218261@lists.php.net to get a copy of this message | ||
Daevid Vincent wrote:
> <?php
> $db = mysql_connect ("localhost","user","password") or die
> ("Could not
> connect to SQL server.");
> mysql_select_db ("rbc",$db) or die ("Could not select RBC Database");
>
> if (isset($_GET['id']) && intval($_GET['id'] > 0))
> {
> $pth = mysql_query("SELECT *, UNIX_TIMESTAMP(party_date) AS
> start, UNIX_TIMESTAMP(DATE_ADD(party_date, INTERVAL 6 HOUR)) AS end FROM
> party_table WHERE party_id = ".$_GET['id']." LIMIT 1", $db);
No idea about your ical question, but you have a nice SQl injection
problem there. You are not casting $_GET['id'] to an integer when you
actually use it. Only when you check the validity, so a bad guy can do
interesting things like ?id=1 or id>1 properly encoded, of course.
Probably not a big deal given your actual query, but for others out
there it is a timely reminder to be very careful how you handle any data
that comes from the user.
-Rasmus