7
Hmmm a number of things. Xoops uses it's own classes for dealing with queries, and this way is ignoring these. Also you're not sanitizing your sql input. intval(), addslashes, stripslahes() etc. When you put something from $_get, $_post directly into your queries you're inviting someone to try posting bad things to your database. But ok. here goes. To continue your script this is how.
$pass = addSlashes($_GET['pass']);
$name = addSlashes($_GET['name']);
$db = mysql_connect("localhost","username","sqlpassword");
if (!$db)
{
die('Could not connect: ' . mysql_error());
}
$sql = "INSERT INTO pass (password) VALUES ('$pass') WHERE name = ('$name')";
if (!mysql_query($sql,$db))
{
die('Error: ' . mysql_error());
}
echo "Success";
mysql_close($db);
?>
This is better though global $xoopsDB;
$myts =& MyTextSanitizer::getInstance();
$pass = $myts->addSlashes($_GET['pass']);
$name = $myts->addSlashes($_GET['name']);
$sql = "INSERT INTO ".$xoopsDB->prefix('pass')." VALUES ('$pass') WHERE name ='$name'";
$result = $xoopsDB->queryF($sql);
?>
