what is mysql injection?

[olddocks]

i heard a lot about mysql injection, dont know how actually people exploit it.

I normally query my mysql like this...

[PHP]select * from table where id-='$_GET[id]'[/PHP]

is this safe way of quering the database?

[Markus]

mysql injection is done through user input, ie. from a user submitting information through a form, and exploiting that form to do harmful things.

[olddocks]

mysql injection is done through user input, ie. from a user submitting information through a form, and exploiting that form to do harmful things.

can you shed more light on this? actually i also use forms to do various things, but dont get your point on how it can be exploited.

[Markus]

great article on it, explaining how it's done and how to prevent it:

http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

[paparts]

re

tuts has one solution for it though there are also negative feedbacks http://net.tutsplus.com/tutorials/to...considerations