Eugene Lee wrote:
Try using more variables to make life a little easier to parse:
        
        $colname = $_FORM['form']
        $query = "select {$colname} from structure";
        $result = mysql_query($query);
        while (($row = mysql_fetch_array($result)) !== false)
        {
            echo $row[$colname];
        }


Very dangerous. $colname can be anything, e.g. "mysql.user.password colname FROM mysql.user #"


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Reply via email to