Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Mladen Gogala Newsgroups: comp.lang.php Subject: Re: fetch items from a row Date: Sun, 4 Aug 2013 17:06:01 +0000 (UTC) Organization: solani.org Lines: 20 Message-ID: References: <8w0ngcjvc3xo$.7xh0lk9pqzs0.dlg@40tude.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Trace: solani.org 1375635961 24041 eJwNw4ERgDAIA8CViklQxhHa7D+C/t0LGTk3U0lZXpw/WkJ2dXdhp5Zpa4q+XoDsOM8OHPADGlUQ+g== (4 Aug 2013 17:06:01 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Sun, 4 Aug 2013 17:06:01 +0000 (UTC) User-Agent: Pan/0.139 (Sexual Chocolate; GIT bf56508 git://git.gnome.org/pan2) X-User-ID: eJwFwYEBwCAIA7CXVGjBc4TR/09YAuNmhxN0CJrOq33mVn3A5mtneae3LyOU06oIcZmdePMDKkgRbQ== Cancel-Lock: sha1:hOf8kNtFPde+mWDuo0WS8U6hWcY= X-NNTP-Posting-Host: eJwFwQcBwEAIBDBLlHGAHMbjX0ITE3wYVxjUzq4rGhSOoHoX7VSXUQ9ppXTKzC0juUurG/MDInURZg== Xref: csiph.com comp.lang.php:10389 On Fri, 03 May 2013 21:49:52 +0100, Tim Streater wrote: > More likely: > > $result = mysql_query("SELECT id,email FROM people WHERE id = '" . > $_GET['number'] . "'"); And the code like that is the basis for all SQL injection attacks. It's so frequent that even comic strips have been written about it: http://xkcd.com/327/ If you have such code in the client facing application, prepare to meet little Bobby Tables. -- Mladen Gogala The Oracle Whisperer http://mgogala.byethost5.com