Re[2]: SQL Injection and Oracle?

2002-02-01 Thread Robert Eskridge
d Nope, you could do it with any sql based database unless your forms have d protection built in. Thankfully our WEB guys did that by accident. Namely when d they accept a data value they have certain rules that they apply to all fields, d like max length, no unlimited length fields, comment

SQL Injection and Oracle?

2002-01-31 Thread Robert Eskridge
Today I've seen two white papers on a technique called SQL Injection for exploiting databases via web pages. One of the papers was pretty much a step by step tutorial on how to reverse engineer data structures and have your way with a SQL Server database via ASP pages. Both papers were ASP/SQL