note 2276 deleted from function.mysql-query by jimw
| From: | jimw@php.net | Date: | Sat, 08 Dec 2001 22:15:08 +0000 |
| Subject: | note 2276 deleted from function.mysql-query by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-22284@lists.php.net to get a copy of this message | ||
Watch out when you make queries based on variables from a surfer. SELECT * FROM table where ID=$ID
can easily be hacked to empty your table. Parse all variables submitted through forms/get if they
are to be used in any similar situation. Of course, the hacker would need to know the name of your
table.