Ford, Mike [LSS] wrote:

$chkboxes = $_POST['ch'];
$sql = 'SELECT ';
foreach($chkboxes as $k => $v)
{
        $sql .= $v;
        if($k < (sizeof($chkboxes) - 1))
        {
                $sql .= ', ';
        }
}
$sql .= ' FROM form';


$sql = 'SELECT ' . implode(', ', $chkboxes) . 'FROM form';

Just note that with either solution, someone can post a value of "* FROM table WHERE 1#" and see everything in any table in your database.


--

---John Holmes...

Amazon Wishlist: www.amazon.com/o/registry/3BEXC84AB3A5E/

php|architect: The Magazine for PHP Professionals – www.phparch.com

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Reply via email to