note 64775 added to control-structures.foreach

The snippet provided by vainternet.co.uk appears to me to be a very bad idea. My take on this is that your database is wide open to attack from users who've manipulated their request variables. In the snippet the variable $key is used to construct the SQL completely unvalidated by the code before it. For instance were I to add a text box to the form called id and enter a value of 999999 the result would be that I've updated the id of the record as well as the other fields! Additionally I suspect that this code suffers from the more usual SQL injection possibility documented many times elsewhere on this site. ---- Server IP: 85.116.0.130 Probable Submitter: 84.92.94.55 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/control-structures.foreach.php Edit -- http://master.php.net/note/edit/64775 Del: integrated -- http://master.php.net/note/delete/64775/integrated Del: useless -- http://master.php.net/note/delete/64775/useless Del: bad code -- http://master.php.net/note/delete/64775/bad+code Del: spam -- http://master.php.net/note/delete/64775/spam Del: non-english -- http://master.php.net/note/delete/64775/non-english Del: in docs -- http://master.php.net/note/delete/64775/in+docs Del: other reasons-- http://master.php.net/note/delete/64775 Reject -- http://master.php.net/note/reject/64775 Search -- http://master.php.net/manage/user-notes.php