note 63352 added to tutorial.forms

Taking user input and concatinating it to a SQL query is one of the worst things you can ever do. What if I were to provide this as the username in your example: joe; update user set password = 'password' ALWAYS convert user input into variables and call stored procedures to do the work. And developers wonder why DBA's wont give them admin rights.... ---- Server IP: 216.194.113.175 Probable Submitter: 24.99.154.175 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/tutorial.forms.php Edit -- http://master.php.net/note/edit/63352 Del: integrated -- http://master.php.net/note/delete/63352/integrated Del: useless -- http://master.php.net/note/delete/63352/useless Del: bad code -- http://master.php.net/note/delete/63352/bad+code Del: spam -- http://master.php.net/note/delete/63352/spam Del: non-english -- http://master.php.net/note/delete/63352/non-english Del: in docs -- http://master.php.net/note/delete/63352/in+docs Del: other reasons-- http://master.php.net/note/delete/63352 Reject -- http://master.php.net/note/reject/63352 Search -- http://master.php.net/manage/user-notes.php