SQL injection on custom page

[kh99]

I don't understand whats going on in those queries, but I guess you have a script that takes an id as a parameter on the url then looks it up in the database. If that's correct, then you probably need make sure the id consists of just digits before using it in a query.

ETA: If you're including some vb code in your script, you might be able to use the "clean_gpc" function to get the parameter (although for TYPE_INT I think it just calls intval() on the value).