Recordset navigation code bug

Question

If you insert a Recordset Navigation Bar for a recordset called (say) Images the following code is generated (by CS6 and previous, at least):
if (isset($_GET['totalRows_rsImages'])) {
  $totalRows_rsImages = $_GET['totalRows_rsImages'];
} else {
  $all_rsImages = mysql_query($query_rsImages);
  $totalRows_rsImages = mysql_num_rows($all_rsImages);
If you later rely on a Show if Recordset is Empty/Not Empty behaviour then there is an opportunity for a (potentially malicious) command line alteration to return an incorrect result, e.g. that the recordset is not empty when it actually is. In otherwords, if someone changes or adds a url parameter called totalRows_rsImages the above code will set $totalRows_rsImages above to that value, whether or not the query has returned records.
A subsequent call to:
if ($totalRows_rsImages == 0) { // Show if recordset empty
will show the region, even if the recordset is empty.
This caught me out, and Adobe should fix it by renaming $totalRows_rsImages to something else where appropriate.

Answer 1

This caught me out, and Adobe should fix it by renaming
$totalRows_rsImages to something else where appropriate.
Yeah, or re-check to make sure it's within range. Not sure how that could be exploited. Forget about Adobe fixing it - they've completely discontinued support of server behaviors.