DING! That's the sound of a little lightbulb turning on... Thanks so much for that tidbit...I could certainly see myself getting screwed by not using such a thing. Dan ----- Original Message ----- From: "Neil Smith [MVP, Digital media]" <php@xxxxxxxxxxxxxxxxxxxxxxxx> To: <php-db@xxxxxxxxxxxxx> Cc: <dan@xxxxxxxxxxxxxxxx> Sent: Monday, May 10, 2004 11:21 AM Subject: RE :I thought "4" didn't equal "456456456%20%20OR%201<>2" > It doesn't. What you're seeing is an SQL injection attack. If you *trust* > the SQL code you allow from POST or GET requests, your SQL server will be > own3d in due course. > > That URL actually translates to 456456456 OR 1<>2 > > Which is always true. So If you use this verbatim, you'll get a true result > (if you were using it as part of a login process, the user would be in > without providing a login and password :-p ) > > I always, *always* apply $result=(integer) $_GET["uid"] to these strings : > That way you are guaranteed it's a number not a string. > > Cheers - Neil > > > >Message-ID: <003b01c43613$65422a10$0501a8c0@dannyboy> > >From: "Dan Bowkley" <dan@xxxxxxxxxxxxxxxx> > >To: <php-db@xxxxxxxxxxxxx> > >Date: Sun, 9 May 2004 15:17:19 -0700 > >MIME-Version: 1.0 > >Content-Type: text/plain; > > charset="iso-8859-1" > >Content-Transfer-Encoding: 7bit > >Subject: Re: supernoob strikes again > > > >I thought "4" didn't equal "456456456%20%20OR%201<>2" > > > ======================================================== > CaptionKit http://www.captionkit.com : Production tools > for accessible subtitled internet media, transcripts > and searchable video. Supports Real Player, Quicktime > and Windows Media Player. > > VideoChat with friends online, get Freshly Toasted every > day at http://www.fresh-toast.net : NetMeeting solutions > for a connected world. > > > > > -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
