|
Injection means putting things into the form response that can cause queries to be, in effect, hijacked so that they do bad things. If you ask for a username and look up all records where user = 'username', then I might post as a username something like "'; DELETE FROM customers WHERE 1 '" Not nice!To avoid this, never put unvalidated/unprocessed user input into a query. Use mysql_real_escape_string on user input, for example.
|