Passing command through URL?

[Steve Railsback]

Greetings all

We're running FM 6 to publish a database online of student clubs. I learned today that we've been hacked. We think someone is passing add new record commands through the URL. Is this possible and can it be blocked?

Thanks!

-steve

[Garry Claridge]

A new record can be created with a "-new" in the URL with something like this:

http://myaddress/FMPro?-dbname=mydb.fp5&-format=-raw&-new

You can use the "Web Security" database to protect against this. Or, you could use PHP to "hide" the database.

All the best.

Garry