<?php
$taxo_id = "1,2,14"; // The taxonomy term ID numbers
$list_no = 5; // Maximum number of posts to list
$sql = "SELECT DISTINCT(n.nid), node.title FROM {node} n INNER JOIN {term_node} tn ON n.nid = tn.nid WHERE tn.tid in ($taxo_id) AND n.status = 1 ORDER BY n.created DESC ";
$result = db_query_range(db_rewrite_sql($sql), 0, $list_no);
$output = "";
while ($anode = db_fetch_object($result)) {
$output .= node_view(node_load($anode->nid), TRUE);
}
print "<div class=\"link-container\">";
print $output;
print "</div>";
?>
How exactly does somebody inject here?
There are no user set variables here, so how is this code insecure?