Re: UPDATE and redirect
| From: | Marcelo Wolfgang | Date: | Wed, 11 Apr 2007 20:57:59 +0000 |
| Subject: | Re: UPDATE and redirect | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-252632@lists.php.net to get a copy of this message | ||
and what if $_GET['id'] is something like "1; DROP TABLE tb_emails;" ?? SQL injection just waits to happenSomething I just thought, he could do a drop table inside an update statement ? because the query is : UPDATE tb_emails SET bol_active = $action WHERE auto_id = $id so if he changed the $action or the $id, it will be inside the UPDATE, doesn't changing any of the variables to a DROP TABLE just give an error ? TIA Marcelo