Tag Info

New answers tagged

-1

Addslashes you will fall in the all mighty encoding... Its basicly a skill war in terms the one that knows more.... Thruth is we say it like that because its sopose to make ppl like you do what your doing unfortunatly in the incorrect place lol. Since the point is to you to learn how to write decent code and not just copy a recepie i will leave some hints, ...


3

Stored procedures are a form of parameterised query. The fundamental problem that causes SQL injection is data being treated as query language. $query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'"; In this example, if I set $password to foo' OR 'x'='x, we get this: SELECT * FROM users WHERE username = 'blah' AND password ...


2

A SQL database works a statement in several steps. At first the test of the SQL statement is parsed, after that it will be optimized and compiled. When this is finished the database has now a internal piece of software that can run the given SQL statement. Stored procedures are pre compiled. In other words the database creates that internal piece of ...


2

This is not susceptible to SQL injection. This method incorporates the prototypical advice for avoiding SQL injection, which is to use parameterized queries. This explicitly separates the data in the arguments from the executable code.


3

It is safe. You have used SqlParameters so you don't need to worry about SQLi in this case. There are situations where using parameters might not protect you from SQLi, like using a parameter to construct dynamic SQL in a stored proc, but there isn't anything like that going on here. This is a textbook example of when parameterization prevents ...


1

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection. If the injection point doesn't use ...


2

Even though noSQL databases are on the rise, the vast majority of web applications still use some kind of SQL database. The basic SQL features are standardized, so many simple SQL queries work on any SQL database. I doubt there is any database which calls itself SQL and doesn't understand password = '' OR '1'='1'. So in many cases it isn't even required to ...


3

It allows to run commands from the SQL shell provided by MS SQL Server. Meaning you can pass commands to be executed by the operating system. Attackers use these to gain complete access to the underlying operating system, rather than just the database and its data.


20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<placeholder>' then I can turn this query to SELECT * FROM users WHERE username = 'admin' AND 1=0 --' when using admin' AND 1=0 -- as value for the placeholder. ...


6

1=0 is always false, so a clause containing AND 1=0 will also always be false. This, like the always-true OR 1=1, can be used to bypass the conditions in a WHERE clause. The OR 1=1 variant is more generally useful (eg. SELECT username WHERE userid=173 to get your username becomes SELECT username WHERE userid=173 OR 1=1 to get every username on the system), ...


0

well it depends on so many things i will be "including some" . 1 web application most web attack are based on scanning lets take the Wordpress as an example you are trying to inject the database of an Wordpress based website .. & wordpress is not sql-I vulnerable but perhaps the plug-ins are vulnerable . you make a scan for the plug-ins installed on the ...


5

There are three common ways to deal with the variety of databases out there: Many web applications are tied to a specific database backend, rather than being able to use a variety of backends. For example, if someone's using MediaWiki, you know they're using either MySQL or MariaDB. An attacker can attempt to generate an error condition, then look at the ...


2

Testers are trying to find bugs that they can get credit for finding; they are not trying to find the last remaining problem. In most cases the input is checked before being passing into SQL by a well written function, or a parameter is used. Therefore it is likely that if even the most basic type of SQL-injection is stopped, then all types of ...


1

It doesn't necessarily mean that they are vulnerable. They may have removed it just for paranoia. However, in my book it is a bad practise to do that. You are changing the name, it's not like an identifier where a character restriction wouldn't matter too much, and it doesn't even mean you are safe. Moreover, the fact that it was removed the day after you ...


27

The character ' is used because this is the character limiter in SQL. With ' you delimit strings and therefore you can test whether the strings are properly escaped in the targeted application or not. If they are not escaped directly you can end any string supplied to the application and add other SQL code after that. The character ; is used to terminate ...


3

Read Wikipedia's examples of SQL injections, in particular the "Incorrectly filtered escape characters" section. Essentially, in an injection you are expected to provide a ready-made command with a parameter. You build this parameter in such a way that it contains an embedded command, whilst respecting the syntax of SQL. Since a command is typically SELECT ...



Top 50 recent answers are included