Exposing content of vars with SQL injection when handling exceptions
<p>If I have this piece of code:</p>

<p><code>query.php:</code></p>

<pre><code>$secret = 'This should not be displayed';
$id = mysql_real_escape_string($_GET['id']);
try {
  mysql_query("SELECT * FROM USERS WHERE USER_ID = '$id'");
  }

catch(Exception $e) {
  echo "Could not execute" . "SELECT * FROM USERS WHERE USER_ID = '$id'";
}
</code></pre>

<p>$id is properly escaped, so no one can inject any code to my query, however, I'm wondering if I GET <code>query.php?id=$secret</code> will it echo the contents of the <code>$secret</code> var because of the echo in the exception handling part?</p>
