Re: sql comment in access

[Robin Wood <dninja () gmail com>]

The -- comment doesn't work, at least not through the interface I've
got access to.

Robin

On 1/23/06, Mark Atherton <matherton () pba co uk> wrote:
> Im pretty sure you can do comments in access sql, just use -- before the
> string and it comments everything after it
>
> Mark Atherton
> IT Developer
> Peter Brett Associates
>
> -----Original Message-----
> From: John Bond [mailto:john.r.bond () gmail com]
> Sent: 23 January 2006 13:31
> To: Robin Wood
> Cc: webappsec () securityfocus com
> Subject: Re: sql comment in access
>
> On 20/01/06, Robin Wood <dninja () gmail com> wrote:
> > Hi
> > I'm trying to get sql injection working against a access db. I've
> > tried the standard -- as a comment and I've also tried %0A and %0D
>
>  I belive that comments arn't possible in access. can you chain two
> commands together e.g.
> ?user=q'%20or%20'a'='a';select%20count(*)%20from%20login%20where%20usern
> ame='a&pass=a
> would produce
> select * from login where username='q' or 'a'='a'; select count(*) from
> login where username='a' and password='a';
>
> ------------------------------------------------------------------------
> -
> This List Sponsored by: Watchfire
>
> Watchfire's AppScan is the industry's first and leading web application
> security testing suite, and the only solution to provide comprehensive
> remediation tasks at every level of the application. See for yourself.
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
> ------------------------------------------------------------------------
> --
>
>
> Visit our new website at: http://www.pba.co.uk
>
> **********************************************************************
> Email is used as a convenient medium for rapid data transfer. Any contractual correspondence
> sent or received by email will not be held to be such unless and until it is received in writing by a Fax or Letter.
>
> Likewise file attachments must be treated as uncontrolled documents until issued as hard copy.
>
> This email and any files transmitted with it are confidential and are intended
> solely for the use of the individual or entity to whom they are addressed.
> If an addressing or transmission error has misdirected this email please notify
> the author by replying to this email and delete the email. If you are not the
> intended recipient you must not use or disclose, print or rely on this email.
>
> Any OS Data attached to this email is issued in accordance with Licence
> No. 100017583 under condition that it is used to plot once and not retained
> on the recipients computer system.
>
> The Partnership accepts no liability for the contents of emails unconnected
> with the affairs of the firm or its clients.
>
> This footnote also confirms that this email message has been swept by
> MailSweeper using Sophos Anti-Virus software for the presence of
> computer viruses, but PBA cannot accept liability for any damage
> which you sustain as a result of software viruses.
>
> www.mimesweeper.com
> **********************************************************************
>
>
> -------------------------------------------------------------------------
> This List Sponsored by: Watchfire
>
> Watchfire's AppScan is the industry's first and leading web application
> security testing suite, and the only solution to provide comprehensive
> remediation tasks at every level of the application. See for yourself.
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------