Re: simple question abt convert to integer
| From: | Vitalii Demianets | Date: | Wed, 25 May 2011 07:52:01 +0000 |
| Subject: | Re: simple question abt convert to integer | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-313146@lists.php.net to get a copy of this message | ||
On Wednesday 25 May 2011 07:05:18 Negin Nickparsa wrote:
> my code is this:
> $query1="select * from patient where id=".$_POST['txt'];
> it works but
Holy Jesus!
Can't wait to send to your server POST request with txt="1;DROP DATABASE; --"
Of course, if you'll switch to prepare statement instead of string embedding
there will be no much fun.
--
Vitalii