Web programming question

[Tree]

Also, the first URL is much less exploitable than the second. All SQL injections are through vuln.com/vuln.php?blabla=1 type URLs, not vuln.com/vuln/1 haha.

That's not true, they are essentially the same thing either way. If an exploit can be applied to the PHP argument itemid, then an exploit would most likely alsrk through the second example.

[323]

That's not true, they are essentially the same thing either way. If an exploit can be applied to the PHP argument itemid, then an exploit would most likely alsrk through the second example.

Oh really? That's cool, I actually didn't know that. I figured the second one wouldn't be able to take the same type of input like the first one does, but I'm guessing you're correct.