4 ms·
In any case the real problem with this line of code is not the int cast, it's that it's using a GET request to delete a record.
by ratsbane 13y ago
In any case the real problem with this line of code is not the int cast, it's that it's using a GET request to delete a record.
- oneeyedpigeon 13y agoNot necessarily - there can still be data in the _GET array, even if the request method is POST.
- ratsbane 13y agoYes, fair point, but I do think it's a red flag. On looking a bit further I see that yes, in fact, he is using a GET link to delete records: https://github.com/Paton/Saaave/blob/master/_views/browse.php https://github.com/Paton/Saaave/blob/master/_views/browse.ph... This is an actual, serious problem which I would note in a code review, as opposed to the int thing which cannot, as far as I can can tell, ever lead to an exploit or malfunction which would have been avoided by using a named escape function in this code. If anyone can think of a specific example to prove this wrong, please say so.