|
|
Posted by Chung Leong on 08/22/06 18:08
Ignoramus20689 wrote:
> I am not a PHP expert (I do mod_perl), but it would seem that this
> code is likely to be a good candidate for SQL injection attack. Is
> that the case? If so, I would write to them.
That's a definitely a SQL injection vulnerability, as the code is
written for PHP3, where there is no register_globals option (i.e. it's
always on). Whether it can be exploited is another matter. I don't
think you can execute multiple statement through mysql_query().
Navigation:
[Reply to this message]
|