You should be pretty safe with that. As long you do not create the sql on the fly you should be OK. Users can make a pretend response and send that back.
IE. Doing this is ok. (I don't know PHP, so the syntax is way off)
if option1.checked = true then
sql = "select highscore from scores"
This is not OK
sql = "select " & option1.value & " from highscores"
The user could put possibly put any old garbage into option1.value. Even if it is a checkbox on the screen.
IE. Doing this is ok. (I don't know PHP, so the syntax is way off)
if option1.checked = true then
sql = "select highscore from scores"
This is not OK
sql = "select " & option1.value & " from highscores"
The user could put possibly put any old garbage into option1.value. Even if it is a checkbox on the screen.