Groups > comp.databases.ms-sqlserver > #1864

SQl -injection

From	"Tony Johansson" <johansson.andersson@telia.com>
Newsgroups	comp.databases.ms-sqlserver
Subject	SQl -injection
Date	2015-01-28 12:45 +0100
Organization	A noiseless patient Spider
Message-ID	<maai3j$iu8$1@dont-email.me> (permalink)

Show all headers | View raw

In the form there is a text field for name

This query is meant to be used like his
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson'      //This name is fetched from the text field 
name in the form
and hemligtNummer = false;

If now the user enter some strange character in the text field in the form 
like this
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
and hemligtNummer = false;

I don't understand how the second query can result that all rows will be 
fetched

//tony

Back to comp.databases.ms-sqlserver | Previous | Next — Next in thread | Find similar

Thread

SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-28 12:45 +0100
  Re: SQl -injection Lennart Jonsson <erik.lennart.jonsson@gmail.com> - 2015-01-28 14:41 +0100
    Re: SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-29 11:03 +0100
  Re: SQl -injection Erland Sommarskog <esquel@sommarskog.se> - 2015-01-28 13:45 +0000

csiph-web