Re: about SQL injection

[Steven DeFord <security.willworker () gmail com>]

On Apr 3, 2005 6:07 AM, Seung Hyun Cho <s970501 () gmail com> wrote:
> I've found vulnerabilities in some pages.
> exploited query is working like...
> "select * from xxx where id=3"
> when I put something like '2 or 1=1', it shows every data in xxx.

Well, the canonical example is

2; drop database

which has obvious downsides.  Also, if your table contains any
sensitive information, bad people seeing it is, obviously, a problem.

-- 
Steven DeFord
Security.Willworker () gmail com
(925) 596-0426

---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security 
professionals.  Norwich University is fulfilling this demand with its MS in 
Information Security offered online.  Recognized by the NSA as an 
academically excellent program, NU offers you the opportunity to earn your 
degree without disrupting your home or work life.

http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------