yeahz Posted October 3, 2009 Report Share Posted October 3, 2009 Man interesē vai šeit ir iespējams ko ļaunu izdarīt (jāskatās ir uz query un uz linku)? Ja jā, tad kā izvairīties? <?php if (!isset($_GET['username'])) { echo "Unknown user"; footer(); exit(); } $user = mysql_query("SELECT id FROM users WHERE username='$_GET[username]'"); ?> adrese izskatās šādi: http://link.lv/sendmessage/username/ Quote Link to comment Share on other sites More sharing options...
waplet Posted October 3, 2009 Report Share Posted October 3, 2009 $username = mysql_real_escape_string($_GET['username']); Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.