PHP and MySQL

[John Madden <chiwawa999 () yahoo com>]

Hi,

I'm pentesting a web site and i get the following
error message while using a single quote: ex.
/confirm.php?conf='test123

Warning: mysql_fetch_row(): supplied argument is not a
valid MySQL result resource in /xx/xx/confirm.php on
line 5

I've looked up the error and attemped numerous
variations like '1==1; etc... but i always get the
same error.

As anyone been succesful in getting information this
way ? If so how?

And how do we fix this vulnerability ? Besides the PHP
code itself (sanitize user input), is it a PHP setting
(php.ini) ?

Thanks for your help

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------