[EMAIL PROTECTED] wrote:

[snip...]

The following is at the beginning of the script:

# get sort order (if any) passed to script
$sort_field = $_REQUEST['sort_field'];
if (! $sort_field) {$sort_field = "(ssa1202.total/vapall.vapall)*100";}
$sort_order = $_REQUEST['sort_order'];
if (! $sort_order) {$sort_order = "desc";}


First things first. That code (it seems to me) is vulnerable to SQL injection. Better fix that first...

   Bruno Ferreira
---
[This E-mail scanned for viruses by Declude Virus]

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Reply via email to