“O que é injeção de SQL” Respostas de código

injeção SQL

imagine if there is an input line on website where you type a name of some dish
to find it , then it will look like something like this:
--------------------------------------------------------------------------------
Your regular input: 
	"Salad" => InputString = "Salad"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'
--------------------------------------------------------------------------------
Your injection try:
	"Salad'; drop table menu --" => InputString = "Salad'; drop table menu --"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'; drop table menu --'
--------------------------------------------------------------------------------
what we are doing is using "Salad';" in input to be able to create new query
after that line , then adding "drop table menu" query or something else if you 
want and in the end "--" part to comment the rest (in our case the apostrophe) 
so we dont get syntax exeption. thats how we dropped menu table

To Defend server: filter symbols like - ; ) etc.  [sorry im not too good in eng]
Powerful Panda

O que é injeção de SQL

SQL injection attacks allow attackers to spoof identity and with existing data,
cause repudiation issues such as voiding transactions or changing balances, 
allow the complete disclosure of all data on the system, destroy the data or 
make it otherwise unavailable
Programmer of empires

Injeção SQL

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
naly moslih

Respostas semelhantes a “O que é injeção de SQL”

Perguntas semelhantes a “O que é injeção de SQL”

Mais respostas relacionadas para “O que é injeção de SQL” em Sql

Procure respostas de código populares por idioma

Procurar outros idiomas de código