Re: Re: Sort Order Description

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



kc68@xxxxxxxxxxx wrote:

[snip...]

The following is at the beginning of the script:

# get sort order (if any) passed to script
$sort_field = $_REQUEST['sort_field'];
if (! $sort_field) {$sort_field = "(ssa1202.total/vapall.vapall)*100";}
$sort_order = $_REQUEST['sort_order'];
if (! $sort_order) {$sort_order = "desc";}


First things first. That code (it seems to me) is vulnerable to SQL injection. Better fix that first...

   Bruno Ferreira
---
[This E-mail scanned for viruses by Declude Virus]

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [PHP Users]     [Postgresql Discussion]     [Kernel Newbies]     [Postgresql]     [Yosemite News]

  Powered by Linux