سؤال للمختصين في امن ال Php

1. <?php
2. include_once('conect.php');
3.  
4. if (isset($_GET['id'])) {
5. $id = intval($_GET['id']);
6.  
7. $res = mysql_query("SELECT filepath, fname, floadscount FROM tbl_books WHERE fid=$id");
8. if ($res)
9. if (mysql_num_rows($res)) {
10. $lROW = mysql_fetch_assoc($res);
11.  
12. $_media_dir = "upload/";
13. $file = $lROW["filepath"];
14. $ffileds = $lROW["fname"];
15. $extension = substr($file,strlen($file)-3,3);
16.  
17. header("Content-Type: ". $extension);
18. header("Content-Length: ". filesize($_media_dir . $file));
19. header("Content-Disposition: attachment; filename=" . $ffileds . "." . $extension);
20. readfile($_media_dir . $file);
21.  
22. $loadsno = $lROW["floadscount"] +1;
23. $lvote=0;
24. if ($loadsno > 1 && $loadsno <= 5 ) $lvote = 1 ;
25. if ($loadsno > 5 && $loadsno <= 10 ) $lvote = 2 ;
26. if ($loadsno > 10 && $loadsno <= 15 ) $lvote = 3 ;
27. if ($loadsno > 15 && $loadsno <= 20 ) $lvote = 4 ;
28. if ($loadsno > 20 ) $lvote = 5 ;
29. mysql_query("UPDATE tbl_books SET floadscount = floadscount + 1, fvote = $lvote WHERE fid=$id");
30.  
31. mysql_free_result($res);
32. }
33. }
34. ?>
35.  

1. $var = $_GET['var'];
2.  

1. $var = mysql_real_escape_string($_GET['var']);
2.  
   
   

a3ghadeer

يعطيك العافيه

طلب بسيط لماذا نستخدم هذا الكود

استخدم معها mysql_real_escape_string

$var = mysql_real_escape_string($_GET['var']);