keldorn Posted October 16, 2009 Share Posted October 16, 2009 I was validating a form input I tried first seeing If I could do an SQL injection with no validation. This was how my query was set up. $var = $_POST['input']; ...mysql_query("UPDATE table SET table='{$var}' WHERE.... I tried inputing things like x" WHERE and """"""" ''''' '''"""etc.. int the form and it had no mysql errors. It just inserted it into the database like that. So does this have something to do with Magic quotes? Quote Link to comment Share on other sites More sharing options...
cags Posted October 16, 2009 Share Posted October 16, 2009 Your question seems a little vague. You say it just inserted into your database? As that is an UPDATE query not an INSERT statement I'm not sure what your getting at as your example injection attempt is blanked out. Have you checked if your server has magic quotes enabled either in the php.ini or using get_magic_quotes_gpc? If they are enabled then this should prevent any SQL injection. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.