note 48436 added to security.database.sql-injection

Hi There is one small error with the above code... It still is an array, and arrays start with 0, not 1. So the query code should be <?php $sqlQuery = 'SELECT col1, col2 FROM tab1 WHERE col1 = {0} AND col3 = {1} LIMIT {2}'; $stm = mysql_query(prepareSQL($sqlQuery, array('username', 24.3, 20); ?> instead of <?php $sqlQuery = 'SELECT col1, col2 FROM tab1 WHERE col1 = {1} AND col3 = {2} LIMIT {3}'; $stm = mysql_query(prepareSQL($sqlQuery, array('username', 24.3, 20); ?> It is a common mistake with programmers, and it makes all the difference. Ich dien ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+48436 Delete -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+48436&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+48436&report=yes Search -- http://master.php.net/manage/user-notes.php