I must be missing something stupid. Here's the script:
<?php
print_r($GET);
$sql = $GET["sql"];
echo "<br>".phpversion()."<br>";
echo "$sql<br>";
?>
Here's the input
http://www.example.com/php/sel.php?sql=select+a+b+frog
Here's the response:
Array ( [sql] => select a b frog )
4.4.9
select a b frog
Change the input to (frog -> from):
http://www.example.com/php/sel.php?sql=select+a+b+from
Response is a 403:
Forbidden
You don't have permission to access /php/sel.php on this server.
Any thoughts?