Karen Challinor

UK

staring at clouds

for whichever deity you worships sake people

basic web design rule #1

"if you accept input from a user or from another web page you damn well verify it for form and if possible content BEFORE passing it on to a database, even if you think it's from a script that you wrote"

and if you think that no one knows the name of scripts, pages or forms on your site, think again, it's very easy to find these things and once found throwing random data and argument names at it until something clicks is always a way to go if a rather slow way

like I keep harping on with government projects, build the security in first

then you can make it look pretty