note 97484 added to security.database.sql-injection

fyrye: I disagree. Changing your tables to make them harder for attackers to guess is the very definition of security through obscurity. (http://en.wikipedia.org/wiki/Security_through_obscurity) It's more likely that someone will damage your database on accident from oddly-named tables than that an attacker will give up after only a few guesses as to table names; after all, what's to prevent them from injecting '; SHOW TABLES; -- into your query? The point here is to lock down the interface you're opening from PHP to the database such that injection isn't possible in the first place. ---- Server IP: 69.147.83.197 Probable Submitter: 68.98.113.127 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/97484 Del: integrated -- https://master.php.net/note/delete/97484/integrated Del: useless -- https://master.php.net/note/delete/97484/useless Del: bad code -- https://master.php.net/note/delete/97484/bad+code Del: spam -- https://master.php.net/note/delete/97484/spam Del: non-english -- https://master.php.net/note/delete/97484/non-english Del: in docs -- https://master.php.net/note/delete/97484/in+docs Del: other reasons-- https://master.php.net/note/delete/97484 Reject -- https://master.php.net/note/reject/97484 Search -- https://master.php.net/manage/user-notes.php