[Programie]

Quote:

Originally Posted by ombre If a person know my Mysql Table or the database structure, it's dangerous? Exploit possible?

Insecure:

Код:

new query[256];
format(query, sizeof(query), "SELECT * FROM `mytable` WHERE `mystring` = '%s' AND `myint` = %d", mystring, myint);
mysql_query(query);

Secure:

Код:

new query[256];
new mystring2[256];
mysql_real_escape_string(mystring, mystring2);
format(query, sizeof(query), "SELECT * FROM `mytable` WHERE `mystring` = '%s' AND `myint` = %d", mystring2, myint);
mysql_query(query);