mysql_error() XSS Vulnerability

不正确使用mysqlerror导致的Vul。当然前提是$db可以覆盖，那么就很鸡肋了，或者就不能叫Vul了，O∩∩OJust For Fun mysqlerror http://hi.baidu.com/menzhi007/blog/item/7583dc0390316d7d3912bbbf.html ?php $db='menzhi007'; extract$GET; $link = mysqlconnect"localhost", "root", ""; mysqlselectdb$db, $link; echo mysqlerror$link; ?...

PHP mysql_error() crosssite scripting

Crossite scripting is possible if mysqlerror result is used in application output...