Thanks for sharing. 2 remarks:
- You can set this to be an addon in the hack details page.
- You are creating a possible SQL insertion. First you do a globalize to an integer for the userid, this is good and would force it to be an integer and removing the SQL insertion possibility. In the query however you are using the $_REQUEST['userid'], making it possible to use a non integer value. Best would be to change this to simple $userid.
|