you missed the -- at the end....that comments anything trailing on that line...like the ending single quote. i am going to echo quite a few people don't play the game with a hacker, hackers are always half a step ahead and if they fall behind they will find a way to get ahead...
Adam H On Tue, 01 Feb 2005 16:15:59 -0800, Jeff Congdon <[EMAIL PROTECTED]> wrote: > which would say '(value);DROP * FROM tableName where 1 = 1' > > ... which would be harmless. at least by sql server, it would be > treated as one long string to insert/update/whatever. > > -jc > > Michael T. Tangorre wrote: > > >>Strings are within single quotes. Can you tamper with '#url.emp_id#' > >>if emp_id is text?? > >> > >> > > > >; DROP * FROM TableName WHERE 1=1 -- > > > > > > > > > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Discover CFTicket - The leading ColdFusion Help Desk and Trouble Ticket application http://www.houseoffusion.com/banners/view.cfm?bannerid=48 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:192714 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
