note 61329 deleted from function.readfile by sp

Note Submitter: 8riaN ---- A quick note on planetmaster's fine code sample. If plan to use it in a potentially hostile environment, such as a public or semi-public website, it needs a tiny tweak to guard against an SQL injection attack . the line: <? # setup SQL statement $sql = " SELECT id, fileurl, filename, filesize FROM ibf_movies WHERE id=' $_GET[id]' "; ?> Allows users to pass a ; and additional SQL directly to the database using the id field to try to crack it or tamper with it. Fortunately there is, in this case, an extremely easy fix for this, the intval() funtion, which will do it's best to return a good number, and return a 0 for anything else - no SQL injection possible. So changet the above to: <? # setup SQL statement $intId = intval($_GET[id]) ; $sql = " SELECT id, fileurl, filename, filesize FROM ibf_movies WHERE id=' $_intID' "; ?> and you're protected.