“¿Qué es la inyección SQL?” Código de respuesta

inyección SQL

imagine if there is an input line on website where you type a name of some dish
to find it , then it will look like something like this:
--------------------------------------------------------------------------------
Your regular input: 
	"Salad" => InputString = "Salad"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'
--------------------------------------------------------------------------------
Your injection try:
	"Salad'; drop table menu --" => InputString = "Salad'; drop table menu --"
query on serever: 
	select * from menu where dish_name = InputString
    					or
    select * from menu where dish_name = 'Salad'; drop table menu --'
--------------------------------------------------------------------------------
what we are doing is using "Salad';" in input to be able to create new query
after that line , then adding "drop table menu" query or something else if you 
want and in the end "--" part to comment the rest (in our case the apostrophe) 
so we dont get syntax exeption. thats how we dropped menu table

To Defend server: filter symbols like - ; ) etc.  [sorry im not too good in eng]
Powerful Panda

¿Qué es la inyección SQL?

SQL injection attacks allow attackers to spoof identity and with existing data,
cause repudiation issues such as voiding transactions or changing balances, 
allow the complete disclosure of all data on the system, destroy the data or 
make it otherwise unavailable
Programmer of empires

Inyección SQL

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
naly moslih

Respuestas similares a “¿Qué es la inyección SQL?”

Preguntas similares a “¿Qué es la inyección SQL?”

Más respuestas relacionadas con “¿Qué es la inyección SQL?” en Sql

Explore las respuestas de código populares por idioma

Explorar otros lenguajes de código