note 48870 added to security.database.sql-injection

Any variables you place inside an SQL query should be wrapped in ''. eg <?php // [...] $query="UPDATE users SET pass='".checkout($_GET['newpass'])."' WHERE id='".checkout($_GET['id'])."'"; // [...] ?> Just so long as your checkout() function makes absolutely sure there are no '' in the returned variable SQL injection isn't an issue. ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+48870 Delete -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+48870&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+48870&report=yes Search -- http://master.php.net/manage/user-notes.php