04-26-2007, 02:24 PM
Just as a matter of principle, you should probably filter the input also. In other words, make sure that the value of $_GET['group'] you receive is on an approved list of values or at least falls within the parameters you have established for legitimate values (e.g. is a single letter or number).
In the code example above, I wrote the user's input directly to the HTML code. That's bad practice since it conceivablly opens up the page to "code injection" attacks. One might insert JavaScript in there for example. Or insert SQL that would potentially screw up your data handling down the line.
In the code example above, I wrote the user's input directly to the HTML code. That's bad practice since it conceivablly opens up the page to "code injection" attacks. One might insert JavaScript in there for example. Or insert SQL that would potentially screw up your data handling down the line.
