Re: Why won't this query work?
| From: | Daniel Brown | Date: | Mon, 24 Mar 2008 18:40:03 +0000 |
| Subject: | Re: Why won't this query work? | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-272050@lists.php.net to get a copy of this message | ||
On Mon, Mar 24, 2008 at 2:29 PM, Jason Pruim <japruim@raoset.com> wrote:
>
> It's already been escaped, $business is pulled out of the database
> after they log in. :)
I don't care, Prune.
(I still get a kick out of knowing that. Who was it, Jochem or
Zoltan who said that? ;-P)
NEVER trust that the data is escaped regardless of where it
originated. Supposed someone else writes a script to tie into your
database and doesn't escape it, and Hagar The Horrible's
great-great(^15) grandson, Hacker The Horndog comes in and finds the
vulnerability, and enters the company name as "';DELETE FROM current
WHERE 1;SELECT * FROM current WHERE 1 "?
Bye, data.
Learn: http://xkcd.com/327/
--
</Daniel P. Brown>
Forensic Services, Senior Unix Engineer
1+ (570-) 362-0283