wends155 / ads Goto Github PK

your delete.php file is liable for a sql injection:

if (isset($_GET['id']))
{
include('../connect_to_mysql.php');
$id = $_GET['id'];
mysql_query("DELETE FROM admin WHERE id='$id'");

this would be safer as:

if ((isset($_GET['id'])) && (is_numeric($_GET['id'])))
{
include('../connect_to_mysql.php');
$sqlq = sprintf("DELETE FROM admin WHERE id='%d'", $_GET['id']);
mysql_query($sqlq);

showed up on a github search that highlights these sort of issues:
https://github.com/search?p=3&q=extension%3Aphp+mysql_query+%24_GET&ref=searchresults&type=Code

This is an automated message
File: delete.php
https://github.com/wends155/ADS/blob/dbdedfac2c8e6889257f5fa2f33c417f260ec91b/admin/custom/delete.php
Needs sanitization on SQL query
See http://php.net/manual/en/security.database.sql-injection.php