Re: i getting this warning

Path	csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
From	Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups	comp.lang.php
Subject	Re: i getting this warning
Date	Wed, 16 Nov 2011 10:41:10 -0500
Organization	A noiseless patient Spider
Lines	35
Message-ID	<ja0lis$cle$2@dont-email.me> (permalink)
References	<616578.124.1321442274513.JavaMail.geo-discussion-forums@prmf13> <ja08dc$qc0$1@dont-email.me> <4ec3d299$0$28440$a8266bb1@newsreader.readnews.com>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	7bit
Injection-Date	Wed, 16 Nov 2011 15:41:16 +0000 (UTC)
Injection-Info	mx04.eternal-september.org; posting-host="0J9bC3jmtvLneyZKWAAHFA"; logging-data="12974"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19e08rE0BnIJDIywzcoB7z4ydSGV9LsYT0="
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20111105 Thunderbird/8.0
In-Reply-To	<4ec3d299$0$28440$a8266bb1@newsreader.readnews.com>
Cancel-Lock	sha1:21dqBJLhORgZkAE1X4rcFYf0PVw=
Xref	x330-a1.tempe.blueboxinc.net comp.lang.php:3810

Show key headers only | View raw

On 11/16/2011 10:11 AM, Denis McMahon wrote:
> On Wed, 16 Nov 2011 06:56:21 -0500, Jerry Stuckle wrote:
>
>> On 11/16/2011 6:17 AM, sri kanth wrote:
>
>>> $qs=$_REQUEST['id'];
>>> $data=mysql_query("select * from tbl_porduct where pid=$qs");
>
>> Three things.
>
> You missed "using unescaped user input in a query with no validation or
> verification". I know it's only a select, but would you bet that he's
> that sloppy with selects and yet rigorous with data changing statements?
>
> I suspect his code would do something unexpected (by him anyway) if I
> sent a get for http://host/page?id=*, as I suspect he only expects the
> query to return a single row. ;)
>
> Perhaps a check that the number of rows returned by the query was however
> many he expected after checking that the query didn't fail would be a
> good thing too?
>
> Rgds
>
> Denis McMahon

Good point, Denis!

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Thread

i getting this warning sri kanth <sritullimilli@gmail.com> - 2011-11-16 03:17 -0800
  Re: i getting this warning The Natural Philosopher <tnp@invalid.invalid> - 2011-11-16 11:26 +0000
    Re: i getting this warning tony@mountifield.org (Tony Mountifield) - 2011-11-16 11:37 +0000
  Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-16 06:56 -0500
    Re: i getting this warning Denis McMahon <denismfmcmahon@gmail.com> - 2011-11-16 15:11 +0000
      Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-16 10:41 -0500
      Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 14:31 +0100
        Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 14:34 +0100
          Re: i getting this warning Denis McMahon <denismfmcmahon@gmail.com> - 2011-11-18 08:02 +0000
        Re: i getting this warning The Natural Philosopher <tnp@invalid.invalid> - 2011-11-17 13:39 +0000
        Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-17 09:01 -0500
          Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-17 15:15 +0100
            Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-17 09:44 -0500
              Re: i getting this warning Arno Welzel <usenet@arnowelzel.de> - 2011-11-21 14:59 +0100
                Re: i getting this warning Jerry Stuckle <jstucklex@attglobal.net> - 2011-11-21 09:12 -0500

csiph-web