SQL Injection Problem

Rikk03 · Worker Joined: Feb 16, 2004 Posts: 164

Why wont this work,

Code:

// Modify Category

$numrows = db->sql_numrows($db->sql_query("SELECT * FROM " . $prefix . "_modules_categories"));
if ($numrows>0) {
OpenTable();
echo "<form method=\"post\" action=\"admin.php\">"
   ."<font class=\"content\"><b>"._MODCATEGORY."</b></font><br><br>";
$result2=$db->sql_query("SELECT mcid, mcname FROM " . $prefix . "_modules_categories order by mcname");

echo ""._CATEGORY.": <select name=\"cat\">";
while(list($mcid2, $mcname2) = $db->sql_fetchrow($result2)) {
   echo "<option value=\"$mcid2\">$mcname2</option>";
}
echo "</select>"
   ."<input type=\"hidden\" name=\"op\" value=\"modules_edit_category\">"
   ."<input type=\"submit\" value=\""._MODIFY."\">"
   ."</form>";
CloseTable();

I get a parse error on the first line, yes I know usually a missing ; or "...I just cant get it right.

sixonetonoffun · Posted: Fri May 07, 2004 5:16 am

Missing a $ in the first db

Rikk03 · Worker Joined: Feb 16, 2004 Posts: 164

Hey thanks, - its funny how you can look so hard and not find the problem ......bloody $

corky · Regular Joined: Feb 29, 2004 Posts: 63

lol, I have made those mistakes