PHP Bug In View Article 1

[d3sol4t3]

Hi

I've got a little bug in my site which is damn hard to fix.

http://www.illworm.com/adm/main.php

^^ Go there first

As you can see it's a news website, click any headline you like (say the 'Bug Needs Fixing' headline).

In your browser it looks like this:

http://www.illworm.com/adm/view_article.php?h=Bug Needs Fixin!

Replace anything after the '=' to whatever you want, say

http://www.illworm.com/adm/view_article.php?h=fdsf

sdf sd f

and hit enter in your browser.

As you can see it prints anything after the '=' onto the screen :\ .

How can i fix this? Source code posted below:

http://www.illworm.com/main1.txt

<== source code to main.php

http://www.illworm.com/view_article1.txt

<=== source code to view_article.php.


Thank You.

 

[d3sol4t3]

Right, I think I have magic_quotes_GPC enabled, thats whats causing the problem. Any other alternative to prevent SQL injection with magic quotes turned on?

 

[d3sol4t3]

ok nm, debugged my code line by line and found that this line:

$res=mysql_query($qry) or die(mysql_error());

should be changed to this:

$res=mysql_query($query) or die(mysql_error());