Bezpečnost dat v MySql DB.

Zdravim, chtel bych se zeptat jak lze otestovat bezpecnost scriptu, ktery vypisuje data z Mysql.
Lze obecne rict, pokud se nevypise Varovna hlaska tak je vse v poradku?
Za jakych okolnosti se muze utocnik dostat do mysql a smazat data?
Diky moc za objasneni.

No v Mysql nic cenného nemám, ale nechci udelat chybu hned na zacatku.
Nejaké zakladni pravidla ktere bych mel dodrzet?

Zde je ukazkovy kod.:

<?
define ("ROWS", 1);
mysql_connect("*******", "******", "******");
mysql_select_db("*******");
mysql_query("set names utf8");
if (!isset($_GET["celkem"]))

{
$vysledek=mysql_query("select count(*) as pocet from potapecske_lokality");
$zaznam=mysql_fetch_array($vysledek); $celkem=$zaznam["pocet"];
} else
{
$celkem=$_GET["celkem"];
}
if ($celkem>ROWS)
{
if (!isset($_GET["od"])) $od=1; else $od=$_GET["od"];
$vysledek=mysql_query("select nazev, hloubka, typ, gps, fotka, popis, zakladna, plnirna, kontakt from potapecske_lokality order by id ASC"." limit ".($od-1).", ".ROWS);

}

else
{
$vysledek=mysql_query("select * from potapecske_lokality order by id ASC");
}

while ($zaznam=MySQL_Fetch_Array($vysledek))
{
echo "<h1";
echo ">";
echo "Potápěčská lokalita ";
echo $zaznam["nazev"];
echo "</";
echo "h1";
echo ">";
echo "<div ";
echo "class=";
echo "'";
echo "lokalita-fotka";
echo "'";
echo ">";
echo "<img src";
echo "=";
echo "'";
echo $zaznam["fotka"];
echo "'";
echo " />";
echo "</div";
echo ">";
echo "<div ";
echo "class=";
echo "'";
echo "lokalita-info";
echo "'";
echo ">";
echo "<table ";
echo "border";
echo "=";
echo "0 ";
echo "class";
echo "=";
echo "'";
echo "lokalitytab";
echo "'";
echo ">";
echo "<tr>";
echo "<td>";
echo "Typ";
echo "</td>";
echo "<td>";
echo $zaznam["typ"];
echo "</td>";
echo "</tr>";
echo "<tr>";
echo "<td>";
echo "GPS";
echo "</td>";
echo "<td>";
echo $zaznam["gps"];
echo "</td>";
echo "</tr>";
echo "<tr>";
echo "<td>";
echo "Hloubka";
echo "</td>";
echo "<td>";
echo $zaznam["hloubka"];
echo " m";
echo "</td>";
echo "</tr>";
echo "<tr>";
echo "<td>";
echo "Základna";
echo "</td>";
echo "<td>";
echo $zaznam["zakladna"];
echo "</td>";
echo "</tr>";
echo "<tr>";
echo "<td>";
echo "Plnírna";
echo "</td>";
echo "<td>";
echo $zaznam["plnirna"];
echo "</td>";
echo "</tr>";
echo "<tr>";
echo "<td>";
echo "Kontakt";
echo "</td>";
echo "<td>";
echo $zaznam["kontakt"];
echo "</td>";
echo "</tr>";
echo "<";
echo "/";
echo "table";
echo ">";
echo "</div";
echo ">";
echo "<";
echo "br ";
echo "/";
echo ">";
echo "<";
echo "br ";
echo "clear";
echo "=";
echo "'";
echo "all";
echo "'";
echo " /";
echo ">";
echo "<h1";
echo ">";
echo "Popis lokality";
echo "</";
echo "h1";
echo ">";
echo "<";
echo "br ";
echo " /";
echo ">";
echo "<div ";
echo "class=";
echo "'";
echo "popis";
echo "'";
echo ">";
echo "<p";
echo ">";
echo $zaznam["popis"];
echo "<";
echo "/";
echo "p>";
echo "</div";
echo ">";
echo "<";
echo "br ";
echo "clear";
echo "=";
echo "'";
echo "all";
echo "'";
echo " /";
echo ">";
}
?>

Díky "($od-1)" sql injection nebude asi možné.
Děkuji Kajmane_.


Jen je teda zvláštní to skládání html kódu, nevypadá to moc přehledně :-)
Jo to tom vim, priste to bude lepsi.