I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in:

<"'>


and also:

' onClick='alert(1);


I'm assuming they were in two different input boxes. But somehow, the user was able to modify the a field in the database to a negative number when the only way (if doing it right which is by pressing a button) is to increment by +1 or -1. For example, user presses the "+1" button, it will +1 in the database. If they press "-1" in the database. They have a negative number of -50 or something like that. What could they have done? What is my website vulnerable of?

Here is the code:

$insertQuery = $dbh->prepare("INSERT INTO fcomments (poster, lid, post_id, comment, time_stamp) VALUES(:user_id, :lid, :post_id, :comment, :timeNow)");
$insertQuery->bindParam(':user_id',$user_id);
$insertQuery->bindParam(':lid',$lid);
$insertQuery->bindParam(':post_id',$post_id);
$insertQuery->bindParam(':comment',$comment);
$insertQuery->bindParam(':timeNow',$timeNow);
$insertQuery->execute();


It looks like all the values are binded. Not sure what could be the problem?

Because of the following reasons:


Performance - it takes up resources destroying files. Imagine an application that uses hundreds or thousands of files. It would be a huge operation to securely delete each one.
Extra wear and tear on the drives.
Sometimes the ability to retrieve a file is a feature of the OS (e.g. Trash, Recycle Bin, Volume Shadow Copy).
As noted by Xander, sometimes the physical storage mechanism is abstracted from the OS (e.g. SSDs or network drives).

