Re: URL syntax?

I would be extremely careful how you use this! I have seen people with URL's like: www.domain.com/directory/page.html?query=select%20*%20from%20table%20where%2 0'id=9' The page is accepting complete queries in the URL!!! Now imagine if I am nice enough to request the page: www.domain.com/directory/page.html?query=delete%20from%20table They now have an empty database. Even phpMyAdmin uses a URL similar to this, but you shouldn't be giving public access to phpMyAdmin anyway. As a sidenote, phpMyAdmin is excellent, I recommend it to anyone. For a solution to your problem, hard code variables into the page, and then send which one to use instead. For example, if you want to query based on one of 3 fields in your database use: $field[0] = "date"; $field[1] = "user"; $field[2] = "project"; And use this URL to specify which to use: www.domain.com/directory/page.html?search_field=1&search_term=JohnDoe Then your final query would be: select * from table where $field[$search_field] = "$search_term" This would return all of the records where the user is JohnDoe, and no one can manipulate your page. HTH, Brian > Hi, > > i need to send requests to a MySQL database via links. Does anyone know the > correct syntax for requests inside an URL? > > ## Daniel Alsén | http://www.eyebee.com # > ## Innehållsbolaget | ICQ: 63006462 # > ## daniel@eyebee.com | Fax: +46 8 4100 1650 # > ## +46 8 4100 1605 | Mob: +46 709 93 57 05 # > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net