in reply to (duplicate) Insert into SQL 2000 from form on web
insert_item ($dbh, param ("content")); is very very very dangerous, since you never validate content other than by stipping whitespace. You're opening yourself up to SQL injection (see first Google hit,OWASP summary).
If you're doing web app development, make sure to read the papers on OWASP, it's an amazing resource. SQL Injection and Cross-site Scripting are the usual points of attack for a webapp. Definately take the time to enderstand them. Remember, never trust the user.
|
|---|