Help with VIEW variables not being seen

[Voodoo Jai]

I have decided to change my select table query to a select view query. Unfortunately it now does not accept the GET variable passed from the URL.

 

Here is the statement:

<?php
$Take_Takeaway = "1";

if (isset($_GET['TakeawayID'])) {
  $Take_Takeaway = (get_magic_quotes_gpc()) ? $_GET['TakeawayID'] : addslashes($_GET['TakeawayID']);
}
mysql_select_db($database_LostMyMenu_conn, $LostMyMenu_conn);
$query_NewView = sprintf("SELECT NewView.TakeawayID,  NewView.Takeaway_Name, NewView.Line1,
NewView.Line2, NewView.Map_Link 
WHERE NewView.TakeawayID = %s 
AND NewView.List_type = list_type. List_TypeID 
AND NewView.City = city.CityID", $Take_Takeaway);
?>

 

when this worked before changing I had to create a variable for the TakeawyID in the WHERE clause shown as "%s" and also "$Take_Takeaway". So why is it defaulting to the first ID of the table the view accesses.

I know someone will point out the assignment of the value "1" at the beginning but this was how it worked before OK. If I comment it out it still defaults to "1".

 

Many thanks

VoodooJai

 

(PS bet its a simple typo that I cant see for looking)

[genericnumber1]

Your script is susceptible to sql injection.

 

See: ?TakeawayID=1 UNION ALL DROP TABLE yourTable --

 

Stick single quotes around %s, that should secure it (to some extent) and maybe fix it. I'd suggest using mysql_real_escape_string() over addslashes() though.

[Voodoo Jai]

Your script is susceptible to sql injection.

 

See: ?TakeawayID=1 UNION ALL DROP TABLE yourTable --

 

Stick single quotes around %s, that should secure it (to some extent) and maybe fix it. I'd suggest using mysql_real_escape_string() over addslashes() though.

No change still after your suggestions, how could I check that my script is secure, what should I be doing.

 

Thanks VoodooJai

[genericnumber1]

well it should be more or less secure as long as you don't allow user variables posted in outside of single quotes.

 

I purposefully did wrong syntax earlier, I don't think that you can use UNION ALL for non-select queries so it shouldn't run (?). Putting it in for your GET wouldn't be a good test to see if you are secure...

[Voodoo Jai]

So is this ok or does it to need single quotes.

 

$query_limit_Recordset1 = sprintf("%s LIMIT %d, %d", $query_Recordset1, $startRow_Recordset1, $maxRows_Recordset1);

 

The problem still defaults to 1, so not cured it.