|
|
Posted by frizzle on 10/13/67 11:49
howac...@gmail.com wrote:
> Hi,
>
> In many web articles, people focusing on SQL injection in the form of :
>
>
> e.g.
> /**********************************************************/
> $name = "tom' UNION blah blah blah"
> $query = "SELECT * FROM users WHERE name = '".$name."';
> /**********************************************************/
>
> However, another form of SQL injection might in the form of...
>
> /**********************************************************/
> $name = "1 UNION blah blah blah"
> $query = "SELECT * FROM users WHERE id = ".$name;
> /**********************************************************/
>
> for case 1, we can easily solved by escaping the special characters
> like " ' ", but how to solve for case 2?
>
> Thanks.
I believe it would treat 1 UNION blah blah blah as a string, meaning
the query would look like
SELECT * FROM users here id = '1 UNION blah blah blah'
Frizzle.
Navigation:
[Reply to this message]
|