RE: SQL Injection Basics

["Forrest Lee Andrews" <lee.andrews () cox net>]

The "'" mark is in fact used in SQL Statements when using VB\VBScript:

Dim sql as string
sql = "select * from foo where bar = 'baz'"

-----Original Message-----
From: Nick Jacobsen [mailto:nick () ethicsdesign com]
Sent: Monday, February 10, 2003 5:07 AM
To: Loki; raul.johhut () hushmail com
Cc: webappsec () securityfocus com
Subject: Re: SQL Injection Basics


Hmm...  just a gues here, but if a developer is using VBScript as the
scripting language, would SQL injection be impossible, since in VBScript the
" ' " mark is a comment mark, and therefore never used in SQL statements?

Nick J
nick () ethicsdesign com