Shallow into shallow out SQL injection

Enter Entertainment news in the search box ) deletecategory where id=3-- appears as shown in the following situation.

As you can see, there is an added entertainment news in the database, but the id=3 record disappears from the database.

Take a look at how the INSERT statement is written, insertinto category (name) values (' Nfdsa '), which is the equivalent of two single quotes entered in the search box, puts the input into this INSERT statement, and the result becomes Insert into category values (' Entertainment news ') Delete category where id=3--'), because the concatenation string is used, Equivalent to writing two full-day SQL statements, Insert into category (' Entertainment news ') and delete category where id= 3, two--equivalent to a comment, the content behind the comment is ignored.

Because SQL statements are implemented by stitching strings, you can tamper with the stitching string. The above example is an artificial concatenation of the string to complete, and then delete a record.

How do you know the name of the table is category? There are many ways. Like what:

First guess the table name

and (Select count (*) from table name) <>0

Guess Column Name

and (Select count (column name) from table name) <>0

Or you can do it.

and exists (SELECT * from table name)

and exists (select Column name from table name)

Returns the correct, then the table or column name is correct

Of course, there are a lot of ways.

So how to avoid SQL injection, do not use the construction of SQL statements directly when inserting. The method of using SQL parameters can avoid this problem to some extent.

public int test () {    int res;    using (cmd = new SqlCommand ("INSERT into category (name) VALUES (@caName)", Getconn ()))    {        cmd. Parameters.Add (New SqlParameter ("@caName", "Entertainment news C ') delete category where id=5--"));        res = cmd. ExecuteNonQuery ();    }    return res;}

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Shallow into shallow out SQL injection