Yup anytime you have a database query that can be changed by the user - when using $_GET $_POST $_REQUEST $_COOKIE etc always check the input..
Use the mysql_real_escape_string function in php to clean the input before you put it into the database. This will help to prevent SQL injection attacks by quoting out special characters.
so when inserting selecting etc always do this..
PHP Code:
$query = "SELECT * FROM table WHERE user='". mysql_real_escape_string($user) ."'";
i got fed up of typing that so i made a little function to make less typing - what can i say i'm a lazy coder
PHP Code:
//Escape the string for the database and add single quotes
function quote($value){
$value = "'" .mysql_real_escape_string($value) ."'";
return $value
}
So your code is now...
PHP Code:
$query = "SELECT * FROM table WHERE user=". quote($user);
Hope this helps someone out