note 97484 deleted from security.database.sql-injection by degeberg

Note Submitter: willbradley ---- fyrye: I disagree. Changing your tables to make them harder for attackers to guess is the very definition of security through obscurity. (http://en.wikipedia.org/wiki/Security_through_obscurity) It's more likely that someone will damage your database on accident from oddly-named tables than that an attacker will give up after only a few guesses as to table names; after all, what's to prevent them from injecting '; SHOW TABLES; -- into your query? The point here is to lock down the interface you're opening from PHP to the database such that injection isn't possible in the first place.