User: the_european

Re:Risk of SQL injection

On: How to Do Everything with PHP and MySQL

Paul Dubois' last edition of MySQL covers, among other interesting topics, using Pear::DB with placeholders.

Risk of SQL injection

On: How to Do Everything with PHP and MySQL

Look at the examples given in the companion web site. There is code like the following, which is highly vulnerable to SQL injection attacks:

$title = $_POST['title'];
$content = $_POST['content'];
$contact = $_POST['contact'];

// validate text input fields
if (trim($_POST['title']) == '')
{
$errorList[] = 'Invalid entry: Title';
}

Validate? Just by removing trailing spaces? People trusting this book's advice will be very sorry soon.

// and later in the script ...

$query = "INSERT INTO news(title, content, contact, timestamp) VALUES('$title', '$content', '$contact', NOW())";
$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());

One more example:

// generate and execute query
$id = $_GET['id'];
$query = "SELECT title, content, contact FROM news WHERE id = '$id'";
$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());

No validation at all! User input thrown into the database without any check!

It's unbelievable that in 2005, after all the outrage and cry about SQL injection ther is still a new book proposing such horrible code!

Re:It's illegal to knowingly download classified d

On: Copy-and-Paste Reveals Classified U.S. Documents

Classified?

Have you read it?

The original document says "UNCLASSIFIED" just on top of every page.