From: "Antti Kurenniemi" 

"Ad"  wrote in
message news:465ff278$1{at}w3.nls.net...
> neat SQL injection
>
> imagine a system which is eval'ing a user against a db using SQL
>
> std 1st line of SQL = "Select * from tableX where fieldA ='"
>
> e.g. tableX = "user" & fieldA = userID but it doesn't
really matter as the
> system is basically looking for a boolean & if true let him in
& give him
> a sessionId.....
>
> So.....fieldA value posted in form the webform =
>
>  ' or 1=1 --
>
> Neat.

That's an old trick. But the good news is, you can spice it up a bit, for
example: ' or 1=1; drop tableX;'. Don't laugh, it actually works some
times.


Antti Kurenniemi
(not on my watch, but I've seen some really, really dangerous code...)

--- BBBS/NT v4.01 Flag-5