这意味着“任意提供的URL参数的名称”？

Question

I got tested my app from the testing company. And they gave MySQl injection vulnerabilities with filenames and message as "name of an arbitrarily supplied URL parameter". I dont know what it means?

Answer 1

It means that you used $_GET or $_REQUEST for database criteria when it may have been inappropriate. If the script only performs SELECT queries then this is not a problem (provided the code is resistant to SQL injection attacks), but data modification should only be performed via POST requests.