Bug #3961 [Opn->Csd]: SQL injection in URL

Edit report at http://pear.php.net/bugs/bug.php?id=3961&edit=1 ID: 3961 Updated by: mj@php.net Reported By: advantis at gmx dot net -Status: Open +Status: Closed Type: Bug Package: Web Site PHP Version: Irrelevant New Comment: This bug has been fixed in CVS. In case this was a documentation problem, the fix will show up at the end of next Sunday (CET) on pear.php.net. In case this was a pear.php.net website problem, the change will show up on the website in short time. Thank you for the report, and for helping us make PEAR better. Previous Comments: ------------------------------------------------------------------------ [2005-03-25 13:36:02] advantis at gmx dot net Description: ------------ The URL Query String is not properly checked. Reproduce code: --------------- http://pecl.php.net/package-stats.php?cid=12%20or%201=1&pid=&rid= Expected result: ---------------- Error Actual result: -------------- Puts the modified parameter as is in the WHERE clause which makes where query return the entire database. ------------------------------------------------------------------------ -- Edit this bug report at http://pear.php.net/bugs/bug.php?id=3961&edit=1