OWASP - User contributions [en]

Talk:Testing for AJAX Vulnerabilities (OWASP-AJ-001)

2007-01-11T20:15:22Z

Woodmi:

I believe that publishing this SQL injection as a test method is extremely dangerous. While professional testers know not to drop tables from databases, inexperienced testers or malicious users could attempt this on sites with potentially disastrous effects.

<pre>
SELECT id FROM users WHERE name='' AND pass=''; DROP TABLE users;
</pre>

I would recommend using a more benign SQL injection example, such as:

<pre>
SELECT id FROM users WHERE name=''or+1=1--' AND pass='';
</pre>

This isn't the best example either as it may allow someone to log into a site, but it's better than dropping the users table. Then again, all SQL injection is dangerous.

Talk:OWASP Testing Guide v2 Table of Contents

2007-01-11T20:15:04Z

Woodmi: added to wrong discussion page, should be on AJAX testing discussion board

Talk:OWASP Testing Guide v2 Table of Contents

2007-01-11T20:12:44Z

Woodmi:

Talk:OWASP Testing Guide v2 Table of Contents

2007-01-11T20:09:39Z

Woodmi: