PHP Code:
$query = mysql_query("SELECT * FROM `download` WHERE id='".mysql_real_escape_string($id)."'");
As opposed to
PHP Code:
$query = mysql_query("SELECT * FROM download WHERE id='".$id."'");
doesn't make it much more complicated - but does make it a heck of a lot more secure. But nice tutorial none-the-less. What does the "ENGINE = InnoDB " at the end of the SQL table mean?