Re: SQL injection (no single quotes used)

[Juan Carlos <johnccr () yahoo com>]

on my!

you are right, this won't work with ADO for example,
my bad :(

Thanks and sorry for sending a not so tested POC to
all of you.

-JC

 --- "Olivier G. Gaumond" <olig () monimap com> escribió:

> Juan Carlos Calderon wrote:
> > Here the MS Documentation for GO Keyword:
> > <snip>
> > SQL Server utilities interpret GO as a signal that
> > they should send the current batch of Transact-SQL
> > statements to SQL Server. The current batch of
> > statements is composed of all statements entered
> since
> > the last GO, or since the start of the ad hoc
> session
> > or script if this is the first GO
> > </snip>
>
> This may work in SQL Server utilities such as Query
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this
> would not work in a 
> query sent by ADO.  At least it doesn't work with
> the ADO.NET SqlClient 
> provider.
>
> Olivier

> ATTACHMENT part 2 application/x-pkcs7-signature
name=smime.p7s
 

_________________________________________________________
Do You Yahoo!?
Información de Estados Unidos y América Latina, en Yahoo! Noticias.
Visítanos en http://noticias.espanol.yahoo.com