By: phil

phil — Sat, 19 Jan 2008 17:15:39 +0000

Quite right marchaos, the examples above shouldn’t be copied and pasted as they are vulnerable to this kind of hack.

A better idea is to escape your value eg

SELECT * FROM articles WHERE title_html = ‘ escape($_GET['title'])’;

where escape() would contain all your data cleansing functions of choice eg addslashes() or mysql_real_escape_string()

By: marchaos

marchaos — Sat, 19 Jan 2008 15:01:16 +0000

$_GET['title'] = ‘”"; drop table articles’;

SELECT * FROM articles WHERE title_html = $_GET['title'];

nuff said.