WebApp Sec mailing list archives
SQL Injection and MSSQL
From: "lipe!" <lipe () brturbo com>
Date: Sat, 26 Jun 2004 07:14:08 -0300
Hi all, With filters like "if the parameter has substring 'SELECT'" a malicious user can mask the 'select' from a request in ASP? I mean something like (that i know witch works in MySQL) "concat(char(1,2,3,4),char(5,6,7))"? MS SQL Server has anyway to mascarade the querys, like some unicode feature or string functions? I just need to know if theres anyway that i can put a select in a query without typing explicit "select". If there, why? Many thanks! ------------------------------------------------------------ Felipe Santos Andrade <lipe () brturbo com> Desenvolvedor TI/WEB Framework .NET -----------------------------------------------------------
Current thread:
- SQL Injection and MSSQL lipe! (Jun 26)
- RE: SQL Injection and MSSQL Mutallip Ablimit (Jun 28)
- <Possible follow-ups>
- RE: SQL Injection and MSSQL Amichai Shulman (Jun 28)