I'm learning about SQL injection and have the following backend code,
Set rs = server.CreateObject("ADODB.Recordset") SQL = "SELECT * FROM Registration WHERE name='"&name&"'" rs.Open SQL,Conn,0,1 if not rs.EOF then message = "Your ID is """ & rs("iD") & """." else message = "id does not exist." end if
I have been able to inject this to pull out a iD, but I'm wondering if it would be possible to go even further and get more info? Based on my code I don't think that is possible since my code only returns the iD DB field.
Am I right?