Re: UPDATE and redirect
| From: | Marcelo Wolfgang | Date: | Wed, 11 Apr 2007 20:36:28 +0000 |
| Subject: | Re: UPDATE and redirect | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-252626@lists.php.net to get a copy of this message | ||
and what if $_GET['id'] is something like "1; DROP TABLE tb_emails;" ?? SQL injection just waits to happenI think tha tit will be too much of a hacker effort just to kill a table of contact emails, and also he will have to guess ( is there other way ? ) the table name, but just to be on a safer side: - Is there a way to say that id can only be a number ? something like $id:Number = $_GET['id']? TIA