Here it is an example of one insecure php code that could be easily to attack:
PHP Code:
$query = "SELECT * FROM users WHERE user='$username'";
mysql_query($query);
If a user insert proper data, it is okay. But if they want to attack you
they can simply insert unproper data like they insert
'; DELETE user.. like
this into your username input. you sql query will be something like
SELECT * FROM users WHERE user=''; DELETE user... Your query will
not perform like you expect. To avoid it you can do like that ccoonen have
said by
using mysql_real_escape_string and the code will be looking like this
PHP Code:
$username = mysql_real_escape_strin($username);
$query = "SELECT * FROM users WHERE user='$username'";
mysql_query($query);
From siLenTz
No more attack....