Re: Is this code safe?
| From: | Hugh Bothwell | Date: | Thu, 28 Mar 2002 12:21:14 +0000 |
| Subject: | Re: Is this code safe? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-90504@lists.php.net to get a copy of this message | ||
"Richard Ellerbrock" <richarde@eskom.co.za> wrote in message
news:sca3181c.059@eskom.co.za...
> $result=mysql_query("DELETE FROM customer
> WHERE customer=$cust",
> $ds) and
> $result=mysql_query("DELETE FROM custinfo
> WHERE customer=$cust",
> $ds) and
> $result=mysql_query("DELETE FROM revdns
> WHERE customer=$cust",
> $ds) and
> AuditLog($ds, sprintf(my_("User %s deleted customer cust %u"),
> $HTTP_SERVER_VARS["PHP_AUTH_USER"], $cust));
Note: you had better do a thorough job of validating $cust, lest someone
pass something charming like
$cust = '39428 or customer > 0';
which might be enough to make your whole *week* interesting.