PHP Code:
$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'",$link);
Very insecure code there...
I could (if I wanted to) change that code to this:
PHP Code:
$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'; UPDATE usertable SET pwd='0wned', admin='I-am-admin', trusted=100",$link);
That might have given me full access to the database...
And all I would have had to do is thus:
www.yoursite.com/script.php?usrInputSearch=blahblah';%20UPDATE %20usertable%20SET%20pwd='0wned',%20admin='I-am-admin',%20trusted=1;
Scary no?