Posted by Chris Hope on 10/17/98 11:16

Angelos wrote:

> First of all sorry if this is not the correct newsgroup for this
> question, but I am using PHP with MYSQL and someone here could have an
> answer and the experience.
>
> I have the a table (content) with some content and every time I edit
> it I store all the table contents in an other table (content_bak) when
> I want to restore the contents
> How am i going to do that ? I am trying to do :
>
> REPLACE INTO content SELECT bak_content_id, bak_content_title FROM
> content_bak WHERE backup_id = '".$_GET['buckup_id']."'";

Beware of SQL injection. You cannot be 100% certain that
$_GET['buckup_id'] is an integer value as someone could modify the
value in the browser's address bar.

Of course, if this is a private script only run by you in a protected
environment then it's not so important but it's something to bear in
mind for public scripts.

[rest snipped]

--
Chris Hope | www.electrictoolbox.com | www.linuxcdmall.com

[Back to original message]