note 88713 deleted from function.mysql-real-escape-string by thiago
| From: | thiago@php.net | Date: | Wed, 04 Feb 2009 15:14:06 +0000 |
| Subject: | note 88713 deleted from function.mysql-real-escape-string by thiago | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-150205@lists.php.net to get a copy of this message | ||
Note Submitter: gomez at bumm dot com
----
can not believe what I see here - the _POST['userid'] in the 3rd example is NOT ESCAPED
and opens the door for SQL INJECTION.
So it is really no wonder that there are so many vulnarable php applications out there if this
manual actually teaches people how to produce vulnarable code.
really, totally annoying.