note 47704 deleted from tutorial.forms by philip
| From: | philip@php.net | Date: | Wed, 24 Aug 2005 21:14:07 +0000 |
| Subject: | note 47704 deleted from tutorial.forms by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-94148@lists.php.net to get a copy of this message | ||
Note Submitter: user at NOSPAM dot example dot com
----
Doing something like:
"delete from some_table where id=' " . $_GET['id']
could be a bad idea from a security standpoint.
All a hacker has to do is change the URL to something like:
blah.com?id=1 or id != 1
...and delete all the rows from some_table.