Re: Translate attempt

francan00@xxxxxxxxx <francan00@xxxxxxxxx> wrote:
PHP:
if(isset($_GET['getClientId'])){
$res = mysql_query("select * from tableOne where clientID='".
$_GET['getClientId']."'") or die(mysql_error());
if($inf = mysql_fetch_array($res)

I wonder, where the value for 'getClientId' comes from.
If it is part of the browser request, then this is highly
susceptible to SQL-injection, and about equivalent to
posting your web-server's administrator password here.

If the value for 'getClientId' is a guaranteed integer,
and stays on the server (i.e. doesn't do a ping-pong
to the client), and only then, it is ok, and my warning
moot.

.