Say there are two queries, which are called after each other: one to get the amount datasets in the table, one to get the result of the actual query:
select count(*) as total from table_a where someCol='abc' and someOtherCol= 'someVariable' select * from table_a where someCol='abc' and someOtherCol= 'someVariable'
someVariable comes directly from userInput (which should not be trusted) and is identical in both queries and is concatenated into the querystring.
This is the approach one of our developers took and he thinks it's completely safe and there is no problem with SQL injection whatsoever.
I injected the following string for
def' UNION select * from table_a where someCol='abc' and someOtherCol= 'someVariable.
The injection doesn't work for the first query, since it has only one column, but does work for the second query (table_a has more than 1 column). This isn't exactly what I call protection against sql injection.... More like two wrongs give one right...
Is there a possibility to make the injection with
UNION work in this scenario? I didn't want to drop all tables, that seemed a bit harsh.