Re: [PHP] Two troublesome fields

2009-02-20 Thread Sean DeNigris
', "; $sql .= "'". mysql_real_escape_string($Notes) ."', "; $WorkOrderID = mysql_insert_id(); mysql_query($sql); There's no closing parethesis to VALUES, try... $sql .= "'". mysql_real_escape_string($Notes) ."')"; Sean DeNigris s...@clipperadams.com

Re: [PHP] Why is this secure?

2009-02-16 Thread Sean DeNigris
rote: On Mon, 2009-02-16 at 13:49 -0500, Sean DeNigris wrote: Hi all! The following code seems like it should be open to session fixation attacks, but is not. Why?! This is the beginning of the private page... header("Location: http://[address of login page]? requestedpage=[token

[PHP] Why is this secure?

2009-02-16 Thread Sean DeNigris
Hi all! The following code seems like it should be open to session fixation attacks, but is not. Why?! This is the beginning of the private page... header("Location: http://[address of login page]?requestedpage=[token for this page]"); exit(); } If an attacker caused a known