Re: PHP and PostgreSQL question on identifier limits.

Поиск
Список
Период
Сортировка
От Matteo Beccati
Тема Re: PHP and PostgreSQL question on identifier limits.
Дата
Msg-id 411FF892.2030007@beccati.com
обсуждение исходный текст
Ответ на PHP and PostgreSQL question on identifier limits.  (Robert Paulsen <robert@paulsenonline.net>)
Ответы Re: PHP and PostgreSQL question on identifier limits.  (Robert Paulsen <robert@paulsenonline.net>)
Список pgsql-general
Hi,

> $_GET['sort'] && $_SESSION['sort']=$_GET['sort'];
> $sort=$_SESSION['sort'];
> $sort || $sort="field1";

First of all I don't feel very comfortable with this exotic syntax, but
this is not the right place to discuss about it ;)


> $query="SELECT
> field1 AS \"<a href=$PHP_SELF?sort=field1>field1</a>\",
> field2 AS \"<a href=$PHP_SELF?sort=field2>field2</a>\",
> field3 AS \"<a href=$PHP_SELF?sort=userid>field3</a>\"
> FROM my_table ORDER BY $sort";
>
> $tbl=new Table($query);
> $tbl->print();

Is there a good reason why you don't add hyperlinks inside your Table
class, instead than using column names for such a purpose?


P.S.
Handling column sorting like you're doing is a big security risk! I hope
you are doing some more checks on $sort, otherwise SQL injection attacks
would be very easy to do.


Best regards
--
Matteo Beccati
http://phpadsnew.com/
http://phppgads.com/

В списке pgsql-general по дате отправления:

Предыдущее
От: Mike Mascari
Дата:
Сообщение: Re: PHP Postgre-MySql call redirector
Следующее
От: Robert Paulsen
Дата:
Сообщение: Re: PHP and PostgreSQL question on identifier limits.