Hi guys, I am not php expert, so be kind to me It seems that problem with the code is that it uses in_array function and it doesn't check the input correctly. I can pass whatever and the sql statement gets printed as output. Should there be modified that part of code with foobar function? thanks PS.: delete the comment if I said to much
It's not accepted, but wouldn't do XXXXX the trick?:
"SELECT 1 FROM `table` WHERE `id`=".XXXX$showX ;
Edited by gizmore:
You are very close.
btw it's XXXXX not XXXXX to XXXX a XXX to an XXX. ;)
The final solution does your idea with just two chars, but with the correct syntax you should already get different messages, saying you are close.