note 36214 deleted from ref.mysql by didou

Note Submitter: andrec69@excite.co.jp ---- This is a comment about maarten's note. Hi, Maarten! I am brend new to PHP and also SQL... (I don't know for example if the function "mysql_query" allows more than one line in a single query. ie: does it allow a semi-colon? I guess it does) I know some stuff about HTTP, though... Well, what I want to say is that your script is unsafe because one can send arbitrary values for your $HTTP_GET_VARS['id']. This means any one could query what ever they want to your database, limted only by the privileges of your 'UID'. (By the way, they say - I don't know why, but probably just because it is deprecated and you have no warranties it will be supported on the future - anyway, they say you shouldn't use HTTP_*_VARS. Of course it is even more UNsafe because you use "GET"... this means any webdesigner could do the trick. This doesn't mean that "POST" is safer!!! It is just that common users would not feel tempted to trying... If you are a user and you see that: http://....php?id=899893 you will probably want to try: http://...php?id=BLAH+BLAH Then you would probably get some specific mysql error messages (I am not sure about this, since I am not familiar to the mysql_query function, but since you don't use the @mysql_query form...) Can you imagine if you were using "like", in place of "="? What if they use "%" (Strictly speaking, they would have to use %%, because % is the escape character for HTTP requests - but I bet many browsers would send %% instead of % even if the user types it only once) http://...php?id=%% This would make a very heavy search regardless of the privilege given to your UID... (id=%%'+sort+by+article would be even heavier!) Supposing the html tag limits the client imput to digits, few people would try anything with "POST". (It is not hard to fake a HTTP request, though). The rule is: "You should not rely on any information that comes from the client (ie. the browser)". Never assume "id" is a sequence of digits! I think it is a good idea to use $_POST instead of $_GET or $_REQUESTS. (you can use $_REQUESTS during the test phase). I am speaking from the point of view of humans, not the thechincal point of view! (Just don't rely on it! It is just "better", not "good") By the way, why do you use "while" in the following? <? while ($line = mysql_fetch_array($result)) { $title=$line['title']; // In the second loop $title will be overwritten $article=$line['article']; // likewise! } ?> Andre Caldas. PS1: Yet, your solution is very nice, and I still think you deserve a job :-) PS2: And me too! I am just graduating from Okayama University (Japan) in March, but I would work in any country (I am from Brasil - I speak Japanese, Portuguese and English). PS3: My field of study is criptography (I use C++), not databases or php.