explode & mktime function

[selvialagar]

[code=php]
$blid=$_GET['blid'];
$query=mysql_qu ery("select * from pms_block,pms_r ental where pms_block.block _id=pms_rental. block_id and pms_rental.bloc k_id=$blid");
$r=mysql_fetch_ object($query);
$parts1 = explode("-",$r->agree_date);
$thatis1 = mktime(12,0,0,$ parts1[1],$parts1[2],$parts1[0]);
$nicedate1 = date("j - F - Y",$thatis1) ;
[/code]

i don't know how explode & mktime function works...
can you tell me that..

[Markus]

Very basic php functions - i suggest you get familiarised with them.

Eplode()

Mktime()

Regards.

[coolsti]

I just feel I do need to add this. Look at these two lines of code:
[php]$blid=$_GET['blid'];
$query=mysql_qu ery("select * from pms_block,pms_r ental where pms_block.block _id=pms_rental. block_id and pms_rental.bloc k_id=$blid");[/php]

Now imagine what would happen if a malicious user modified the URL that would normally be created when submitting your form:

https://www.yoursite.com/yourphpfunc...?blid=1;delete from pms_block;delet e from pms_rental

Obviously the hacker in this case would need to know the names of your database tables for this example to work, but I am sure one can come up with many other more generalized sql statements that could be just as dangerous. In the above case, this URL combined with your script will cause the two tables pmd_block and pms_rental to be emptied completely.

The moral of the story: never use $_GET or $_POST variables directly in SQL or other executable statements without validation and appropriate filtering of anything malicious.

Steve, Denmark

Please enclose your posted code in [code] tags (See How to Ask a Question). - moderator