When.com Web Search

Search results

1. Results From The WOW.Com Content Network

2. security - How does the SQL injection from the "Bobby Tables"...

   stackoverflow.com/questions/332365

   The potential impact of a successful SQL injection attack cannot be underestimated--depending on the database system and application configuration, it can be used by an attacker to cause data loss (as in this case), gain unauthorized access to data, or even execute arbitrary code on the host machine itself.

3. SQL Injection: or 1=1 vs ' or 1=1; -- - - Stack Overflow

   stackoverflow.com/questions/60939830

   Trying to learn and understand SQL injection. Can anyone explain to me why ' or 1=1; -- - allowed me to bypass authentication and or 1=1 did not?

4. Which characters are actually capable of causing SQL injection in...

   stackoverflow.com/questions/14370670

   Using parameterized queries is considered the only proper way to protect from SQL injections, for the reasons provided in the original answer below: Which characters are actually capable of causing SQL injection in mysql. There are no such characters. It isn't "characters" that cause the SQL injections, but improper formatting.

5. How can I prevent SQL injection in PHP? - Stack Overflow

   stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

   Use of mysql_real_escape_string(), which is a pre-defined function in PHP, and this code add backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a. Pass the input values as parameters to minimize the chance of SQL injection. The most advanced way is to use PDOs. I hope this will help you.

6. How does SQLParameter prevent SQL Injection? - Stack Overflow

   stackoverflow.com/questions/4892166

   A simple SQL injection would be just to put the Username in as ' OR 1=1--. This would effectively make the SQL query: sqlQuery='SELECT * FROM custTable WHERE User='' OR 1=1-- ' AND PASS=' + password. This says select all customers where their username is blank ('') or 1=1, which is a boolean, equating to true.

7. How can I avoid SQL injection attacks in my ASP.NET application?

   stackoverflow.com/questions/305044

   Here @Name is the parameter where you want to avoid sql injection and conn is an SqlConnection object. Then to add the parameter value you do the following: getPersons.Parameters.AddWithValue("@Name", theName); Here theName is a variable that contains the name you are searching for.

8. What are good ways to prevent SQL injection? - Stack Overflow

   stackoverflow.com/questions/14376473

   1. The first and simplest approach for SQL injection is the approach to end the current string and statement by starting your value with a single or double quote followed by a brace and semicolon. So by checking the given input if it starts with those would be a good hint, maybe by a regex like ^\s*['"]\s*\)\s*;.

9. Can I protect against SQL injection by escaping single-quote and...

   stackoverflow.com/questions/139199

   Second-order SQL Injection - if an SQL query is rebuilt based upon data retrieved from the database after escaping, the data is concatenated unescaped and may be indirectly SQL-injected. See See String truncation - (a bit more complicated) - Scenario is you have two fields, say a username and password, and the SQL concatenates both of them.

10. What is SQL injection? - Stack Overflow

    stackoverflow.com/questions/601300

    SQL Injection occurs when the user of an application is able to affect the meaning of database query. This often occurs when arbitary strings from user input are concatenated to create SQL which is fed to the database. For example lets say we had the following code (in PHP, but the same holds true for any language), which might be used to ...

11. Testing if a site is vulnerable to Sql Injection - Stack Overflow

    stackoverflow.com/questions/10281349

    SQL injection is the attempt to issue SQL commands to a database through a website interface, to gain other information. Namely, this information is stored database information such as usernames and passwords. First rule of securing any script or page that attaches to a database instance is Do not trust user input.