index.php?page=item&id=9'A=0

[thoughtless]

I belive that some people try to SQL inject something in my website,

Code: Select all

index.php?page=item&id=9'A=0

The bad news is that they can see Full Path Disclosure:
Notice: Undefined variable: file in /var/www/domain.com/public_html/inc/pages/item.inc.php on line 2
Invalid item ID. Please check the URL.

[bitfreak]

You should have error reporting completely disabled when the shop is live so those error messages don't show up.

[thoughtless]

Yeah, I forgot about that. Thank you.