KirstenS: Talk:Testing for AJAX Vulnerabilities moved to Talk:Testing for AJAX Vulnerabilities (OWASP-AJ-001)

2008-12-16T00:04:50Z

Talk:Testing for AJAX Vulnerabilities moved to Talk:Testing for AJAX Vulnerabilities (OWASP-AJ-001)

Woodmi at 20:15, 11 January 2007

2007-01-11T20:15:22Z

New page

I believe that publishing this SQL injection as a test method is extremely dangerous. While professional testers know not to drop tables from databases, inexperienced testers or malicious users could attempt this on sites with potentially disastrous effects.

<pre>
SELECT id FROM users WHERE name='' AND pass=''; DROP TABLE users;
</pre>

I would recommend using a more benign SQL injection example, such as:

<pre>
SELECT id FROM users WHERE name=''or+1=1--' AND pass='';
</pre>

This isn't the best example either as it may allow someone to log into a site, but it's better than dropping the users table. Then again, all SQL injection is dangerous.

← Older revision	Revision as of 00:04, 16 December 2008
(No difference)

Talk:Testing for AJAX Vulnerabilities (OWASP-AJ-001) - Revision history

KirstenS: Talk:Testing for AJAX Vulnerabilities moved to Talk:Testing for AJAX Vulnerabilities (OWASP-AJ-001)

Woodmi at 20:15, 11 January 2007