Geek asks and answers

MySQL query bypass

In MySQL, comments can be inserted into keywords , which provides another way to circumvent some input validation filters, while preserving the syntax of the actual query. For instance:

SEL/*foo*/ECT username,password FR/*foo*/OM users

But how can one comment things between saved words? what is the advantage? And why is this a kind of workaround?

It seems to be buggy!

+5
source share
2 answers

This quote is from a book since 2007 ... maybe this was true for earlier versions of MySql, but I can not find a version of MySQL in which this syntax does not return an error.

, SQL, .

, Sql Injection , DELETE... DEL/**/ETE.

, - , SQL... SQL , , , .

OWASP:

, SQL-. , :

  • ,
  • ,
+4

. mysql, , mysql.
(5.5.24), , :

sele/*ops*/ct name from tableName

:

You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'sele/*ops*/ct name from
tableName' at line 1

:

select na/*ops*/me from tableName

:

Unknown column 'na' in 'field list'

, . , :

select name/*ops*/ from tableName
+1

More articles:


All Articles