 <p>Like the other answers above, i agree that this is just asking for an injection attack (and probably other types). Some things that you can do to prevent that and enhance security in other ways could be the following:</p> <p>1 Look for something suspicious with your response handler. Lack of a query variable in the post, for instance, doesn't make sense, so it should just kill the process.</p> <pre><code>@$_POST["query"] or die('Restricted access'); </code></pre> <p>2 Use preg_match to sanatize specific fields.</p> <pre><code>if (!preg_match("/^[a-zA-Z0-9]+$/", $_POST[query])){ die('Restricted access'); } </code></pre> <p>3 Use more fields, even if they are semi-meaningless and hidden, to add more reasons to kill the process through their absence, or lack of a certain text pattern (optional).</p> <p>4 You shouldn't send a complete query through the POST at all. Just the elements that are necessary as input from the user. This will let you build the query in PHP and have more control of what actually makes it to the final query. Also the user doesn't need to know your table names</p> <p>5 Use mysql_real_escape_string on the posted data to turn command characters into literal characters before entering data into a db. This way someone would have a last name of DROP TABLE whatever, instead of actually dropping table whatever.</p> <pre><code>$firstname = mysql_real_escape_string($_POST[fname]); $lastname = mysql_real_escape_string($_POST[lname]); $email = mysql_real_escape_string($_POST[email]); $sql="INSERT INTO someTable (firstname, lastname, email) VALUES('$firstname','$lastname','$email')"; </code></pre> <p>6 Last, but not least, be creative, and find more reasons to kill your application, while at the same time giving the same die message on every die statement (once debugging is done). This way if someone is hacking you, you don't give them any feedback that they are getting through some of your obstacles.</p> <p>There's always room for more security, but this should help a little.</p>