Quote:
|
Originally Posted by Richard M
PHP Code:
$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'",$link);
Very insecure code there...
I could (if I wanted to) change that code to this:
PHP Code:
$result = mysql_query("SELECT * FROM tblMyTable WHERE requiredfield = '$usrInputSearch'; UPDATE usertable SET pwd='0wned', admin='I-am-admin', trusted=100",$link);
That might have given me full access to the database...
And all I would have had to do is thus:
www.yoursite.com/script.php?usrInputSearch=blahblah';%20UPDATE %20usertable%20SET%20pwd='0wned',%20admin='I-am-admin',%20trusted=1;
Scary no? |
Yep, very scary
So, how do I get round that?
This is my first attempt at doing
anything with PHP
