Bad habit of (*) perhaps. Thinking "It's just a count"

• This reply was modified 7 years ago by homebrew01.
• This reply was modified 7 years ago by homebrew01.

Looks like a forum software downgrade to me. Yuck.

I can't figure out these damn BBCodes.

If a stored procedure isn't an option, then another safe guard would be to grant the mssql account used by the Contact page to have only insert permission on...

Thanks. This particular page only seems to have a few instances that need to be modified.

But there are probably other pages on the website that are vulnerable.

Looks like we have some "Bad" code.

Thoughts ??

$sql = "update MyTable set Username=".$memNum." where memNum=".$memNum;
$results = mssql_query($sql, $dbconn);

.

There's some other using SP writing to WordPress:

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.

This reply was modified 7 years ago by homebrew01.