Active Record Vulnerability or Misunderstanding?

[eluser]WanWizard[/eluser]
If you pass an unset session variable, you're passing FALSE.

Since you can't pass a boolean to a query, it is converted to a string. The result is

Code:

SELECT * FROM (`testusers`) WHERE `id` = 0

If id is an integer field, it returns only that row (if it exists).

If id is a character field, the syntax is incorrect. "id = 0" evaluates to "is the string 'id' false'", which is true, so the query becomes "SELECT * FROM testusers WHERE TRUE", which returns all records.