Re: Scripting Languages and Secure Coding + code

[securecodingorg () nuvisions ch]

On Thursday 04 December 2003 16:34, Jeremy Thibeaux wrote:
> Imagine if the user entered:
>
> "someuser' OR username ='someuser" for $username.
> Your SQL statement would turn out:

Hey, if you're using SQL there, the user may just enter '%' or any other 
wilcard char, which makes it a lot easier. When testing you'll find that this 
works with just too many apps.