Posted by Jerry Stuckle on 08/24/05 16:13

Doug Johnston wrote:
> Hi,
>
> I am trying to pass the following and it keeps giving the same error...
>
> http://www.megamotza.com/cst_hsql.php?firstlogin=Y&abc=sysman&sql=select%20*%20from%20sysuser%20where%20companies%20LIKE'%0002%'%20AND%20usrflag%20='U'&tblname=curSysuser
>
>
> ...the problem is the LIKE '%0002%'. If I remove the %'s from each side
> of the value, no error.
>
> Anyone got any ideas
>
> Regards
> Doug Johnston

Maybe pass it through urlencode() first?

Or, better yet - DON'T PASS THE SQL IN THE REQUEST!, i.e.

http://www.megamotza.com/cst_hsql.php?firstlogin=Y&abc=sysman&sql=delect%20from%20sysuser.curSysuser

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[Back to original message]