“Qu'est-ce que l'injection SQL” Réponses codées

injection SQL

imagine if there is an input line on website where you type a name of some dish
to find it , then it will look like something like this:
--------------------------------------------------------------------------------
Your regular input: 
	"Salad" => InputString = "Salad"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'
--------------------------------------------------------------------------------
Your injection try:
	"Salad'; drop table menu --" => InputString = "Salad'; drop table menu --"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'; drop table menu --'
--------------------------------------------------------------------------------
what we are doing is using "Salad';" in input to be able to create new query
after that line , then adding "drop table menu" query or something else if you 
want and in the end "--" part to comment the rest (in our case the apostrophe) 
so we dont get syntax exeption. thats how we dropped menu table

To Defend server: filter symbols like - ; ) etc.  [sorry im not too good in eng]
Powerful Panda

Qu'est-ce que l'injection SQL

SQL injection attacks allow attackers to spoof identity and with existing data,
cause repudiation issues such as voiding transactions or changing balances, 
allow the complete disclosure of all data on the system, destroy the data or 
make it otherwise unavailable
Programmer of empires

Injection SQL

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
naly moslih

Réponses similaires à “Qu'est-ce que l'injection SQL”

Questions similaires à “Qu'est-ce que l'injection SQL”

Plus de réponses similaires à “Qu'est-ce que l'injection SQL” dans Sql

Parcourir les réponses de code populaires par langue

Parcourir d'autres langages de code