|
|
 |
|
|
Thread Tools | Display Modes |
Oct 25th, 2006, 5:32 PM
|
#1 |
|
Programmer
Join Date: Jan 2005
Location: Albany, NY
Posts: 43
Rep Power: 0
 |
SQL injection on an insert query.
Firstly, this is not going to be used maliciously. It is for test purposes on a BBS that I'm coding.
How would I go about injecting an insert query? I'll use a generic code: mysql_query("INSERT INTO data (fData, sData) VALUES('" + $fData + "', '" + $sData + "')");Let's say the variables $fData and $sData come straight from my html forum without passing through any checks(no strip_tags() or get_magic_quotes_gpc() functions). Now, I know how to inject a select from query, but I don't know how I would inject this? Any help is appreciated.
__________________
meh... |
|
|
|
Oct 25th, 2006, 6:22 PM
|
#2 |
|
Resident Grouch
 
Join Date: Jun 2005
Posts: 6,453
Rep Power: 10
|
This is borderline, regarding the forum's rules. There are a lot of places that discuss such things freely. One thing I wonder is why you wouldn't untaint or sanitize user's input? Then you would only have to test against robust code.
__________________
Abstraction doesn't make it impossible to write bad code; it makes it possible to write superior code. Contributor's Corner: Grumpy on C++ Exceptions DaWei on Pointers |
|
|
|
|
Nov 5th, 2006, 7:14 PM
|
#3 |
|
Newbie
Join Date: Oct 2006
Posts: 20
Rep Power: 0
|
You can test it out by putting in ' or " and direct sql statements to see if it affects your data.
You could just put in a ' in your input fields and if you get an error back like this (then you are vulnerable): "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax' at line X" |
|
|
|
|
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| C# VS 2005 - SQL Query Parameters to an ODBC DataSource | jcrcarmo | C# | 3 | Apr 10th, 2006 3:58 PM |
| Process injection | jayme | C++ | 3 | Jan 28th, 2006 6:05 AM |
| Operation must use an updateable query.!!! | paulchwd | ASP | 3 | Aug 24th, 2005 10:36 PM |
| How to detect cursor location and insert text??? | syntax-error | C# | 3 | Jun 30th, 2005 1:42 AM |
Linear Mode
