Quote:
|
Originally Posted by MattD
Plain text posted is being inserted into the query. So, in theory, someone could submit something that could potentially alter the query. My advice would be to look into using the mysql_escape_string() or the mysql_real_escape_string() function.
|
Or, he could just make sure that no one but an administrator can get to that page. Dont execute the query if you arent logged in!
PHP Code:
if ($_SESSION['UserClass'] == 'Admin') { }
or something like that. but if you do that, you would need to setup a login system.
I used to have a bunch of tutorials that i made about how to do this stuff.