How SQL Injection Works  Hot PDF Print E-mail
Tag it:
Delicious
Furl it!
Digg
NewsVine
Reddit
YahooMyWeb
Technorati
Articles Reviews Structured Query Language
Written by JOHN   
Tuesday, 07 November 2006

{mos_sb_discuss:29}

Constructing a database query is a perfectly straightforward process. It typically proceeds something like this (for demonstration purposes, we'll assume that you have a database of wines, where one of the fields is the grape variety):


  1. You provide a form that allows the user to submit something to search for. Let's assume that the user chooses to search for wines made from the grape variety "lagrein."
  2. You retrieve the user's search term, and save it by assigning it to a variable, something like this: 
    SnyderSouthwell_5084.book  Page 250  Saturday, July 16, 2005  6:14 AM
 
 
 
 
 
 
 
$variety = $_POST['variety'];
    So that the value of the variable $variety is now this: 
    lagrein
  3. You construct a database query, using that variable in the WHERE clause, something like this: 
    $query = "SELECT * FROM wines WHERE variety='$variety'";
    so that the value of the variable $query is now this: 
    SELECT * FROM wines WHERE variety='lagrein'
  4. You submit the query to the MySQL server.
  5. MySQL returns all records in the wines table where the field variety has the value "lagrein."

 



User reviews

There are no user reviews for this item.

Add new review




Powered by jReviews
Last Updated ( Sunday, 11 February 2007 )
 
< Prev   Next >
[ Back ]