CodingForums.com - View Single Post

Zangeel · 08-01-2009, 09:09 PM

PHP Code:


			
$id=$_GET['id']; 
$result = mysql_query("UPDATE privatemsg SET prefix='' WHERE id='$id'")

Suppose someone alters the URL like ...id?=' AND DROP TABLE `users`");# or whatever.

You can use

PHP Code:


			
$id = (int) $_GET['id']; //if it's numerical or if it's not mysql_real_escape_string

08-01-2009, 09:09 PM	PM User \| #6
Zangeel Regular Coder Join Date: Oct 2007 Location: public_html/ Posts: 638 Thanks: 17 Thanked 79 Times in 79 Posts	PHP Code: `$id=$_GET['id']; $result = mysql_query("UPDATE privatemsg SET prefix='' WHERE id='$id'")` Suppose someone alters the URL like ...id?=' AND DROP TABLE `users`");# or whatever. You can use PHP Code: `$id = (int) $_GET['id']; //if it's numerical or if it's not mysql_real_escape_string` __________________ PHP Code: `$aString = is_string((string)array()) ? true : false; // true :D` [/CENTER]