sql injection through address bar.

[harmor19]

I am reading this article on security and it mentions something about passing data through the address bar.

If I had

PHP Code:

UPDATE $table SET ReadCount = ReadCount + 1 WHERE MessageID = $MID; 


I could pass this through the address bar

PHP Code:

mypage.php?table=admin SET Password = 'foo';# 


I noticed that I have this in my own script

PHP Code:

$query="UPDATE rpg_character 
     SET 
     move_v = '$move_v', 
     move_h ='$move_h'
     WHERE characterid='".$rpg['characterid']."'";
     mysql_query($query); 


So I wanted to test it but it doesn't work.

PHP Code:

rpg_index.php?move_v='60' WHERE characterid = '1'; # 


Here's the article http://www.hudzilla.org/phpbook/read.php/17_1_1

I am guessing that browsers recognize the "#" character.