Groups > comp.databases.ms-sqlserver > #1864

SQl -injection

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail
From	"Tony Johansson" <johansson.andersson@telia.com>
Newsgroups	comp.databases.ms-sqlserver
Subject	SQl -injection
Date	Wed, 28 Jan 2015 12:45:13 +0100
Organization	A noiseless patient Spider
Lines	22
Message-ID	<maai3j$iu8$1@dont-email.me> (permalink)
Mime-Version	1.0
Content-Type	text/plain; format=flowed; charset="iso-8859-1"; reply-type=original
Content-Transfer-Encoding	7bit
Injection-Date	Wed, 28 Jan 2015 11:44:51 +0000 (UTC)
Injection-Info	mx02.eternal-september.org; posting-host="8fdc2b5af81c338deb7045fc6c39b0e2"; logging-data="19400"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18+A9QI8n9RQOIVysIHRjBh"
X-MimeOLE	Produced By Microsoft MimeOLE V6.0.6002.18463
X-Newsreader	Microsoft Windows Mail 6.0.6002.18197
Cancel-Lock	sha1:hCxTWO//DJkxmUB0CaN/AZNEsss=
X-Priority	3
X-MSMail-Priority	Normal
Xref	csiph.com comp.databases.ms-sqlserver:1864

Show key headers only | View raw

In the form there is a text field for name

This query is meant to be used like his
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson'      //This name is fetched from the text field 
name in the form
and hemligtNummer = false;

If now the user enter some strange character in the text field in the form 
like this
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
and hemligtNummer = false;

I don't understand how the second query can result that all rows will be 
fetched

//tony

Back to comp.databases.ms-sqlserver | Previous | Next — Next in thread | Find similar

Thread

SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-28 12:45 +0100
  Re: SQl -injection Lennart Jonsson <erik.lennart.jonsson@gmail.com> - 2015-01-28 14:41 +0100
    Re: SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-29 11:03 +0100
  Re: SQl -injection Erland Sommarskog <esquel@sommarskog.se> - 2015-01-28 13:45 +0000

csiph-web