Re: SQL injection (no single quotes used)

["Olivier G. Gaumond" <olig () monimap com>]

Juan Carlos Calderon wrote:
> Here the MS Documentation for GO Keyword:
> <snip>
> SQL Server utilities interpret GO as a signal that
> they should send the current batch of Transact-SQL
> statements to SQL Server. The current batch of
> statements is composed of all statements entered since
> the last GO, or since the start of the ad hoc session
> or script if this is the first GO
> </snip>

This may work in SQL Server utilities such as Query Analyzer, but the GO 
keyword is not part of the T-SQL language, so this would not work in a 
query sent by ADO.  At least it doesn't work with the ADO.NET SqlClient 
provider.

Olivier

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature