|
Posted by Toby A Inkster on 02/06/07 00:49
Jerry Stuckle wrote:
> http://www.example.com?sql=delete%20from%20orders
Given the sample code posted:
<?php
error_reporting(E_ALL);
$query = $_GET['sql'];
echo $query;
?>
Your query would just print:
delete from orders
Which would not be insecure in the slightest -- after all, the script
doesn't even open a database connection!
--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/CSS/Javascript/SQL/Perl/PHP/Python*/Apache/Linux
* = I'm getting there!
Navigation:
[Reply to this message]
|