|
|
Posted by Rasmus Lerdorf on 07/07/05 02:44
Daevid Vincent wrote:
> <?php
> $db = mysql_connect ("localhost","user","password") or die ("Could not
> connect to SQL server.");
> mysql_select_db ("rbc",$db) or die ("Could not select RBC Database");
>
> if (isset($_GET['id']) && intval($_GET['id'] > 0))
> {
> $pth = mysql_query("SELECT *, UNIX_TIMESTAMP(party_date) AS
> start, UNIX_TIMESTAMP(DATE_ADD(party_date, INTERVAL 6 HOUR)) AS end FROM
> party_table WHERE party_id = ".$_GET['id']." LIMIT 1", $db);
No idea about your ical question, but you have a nice SQl injection
problem there. You are not casting $_GET['id'] to an integer when you
actually use it. Only when you check the validity, so a bad guy can do
interesting things like ?id=1 or id>1 properly encoded, of course.
Probably not a big deal given your actual query, but for others out
there it is a timely reminder to be very careful how you handle any data
that comes from the user.
-Rasmus
Navigation:
[Reply to this message]
|