I'm learning about SQL injection and have the following backend code,
Set rs = server.CreateObject("ADODB.Recordset")
SQL = "SELECT * FROM Registration WHERE name='"&name&"'"
rs.Open SQL,Conn,0,1
if not rs.EOF then
message = "Your ID is """ & rs("iD") & """."
else
message = "id does not exist."
end if
I have been able to inject this to pull out a iD, but I'm wondering if it would be possible to go even further and get more info? Based on my code I don't think that is possible since my code only returns the iD DB field.
Am I right?