note 61329 added to function.readfile

A quick note on planetmaster's fine code sample. If plan to use it in a potentially hostile environment, such as a public or semi-public website, it needs a tiny tweak to guard against an SQL injection attack . the line: <? # setup SQL statement $sql = " SELECT id, fileurl, filename, filesize FROM ibf_movies WHERE id=' $_GET[id]' "; ?> Allows users to pass a ; and additional SQL directly to the database using the id field to try to crack it or tamper with it. Fortunately there is, in this case, an extremely easy fix for this, the intval() funtion, which will do it's best to return a good number, and return a 0 for anything else - no SQL injection possible. So changet the above to: <? # setup SQL statement $intId = intval($_GET[id]) ; $sql = " SELECT id, fileurl, filename, filesize FROM ibf_movies WHERE id=' $_intID' "; ?> and you're protected. ---- Server IP: 216.194.113.175 Probable Submitter: 168.103.6.91 ---- Manual Page -- http://www.php.net/manual/en/function.readfile.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+61329 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+61329&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+61329&report=yes Search -- http://master.php.net/manage/user-notes.php