a web application example n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
A Web Application Example PowerPoint Presentation
Download Presentation
A Web Application Example

Loading in 2 Seconds...

play fullscreen
1 / 3

A Web Application Example - PowerPoint PPT Presentation


  • 63 Views
  • Uploaded on

A Web Application Example. SQL Injection!. <%@ LANGUAGE="VBSCRIPT" %> <% Dim oCONv, oRSu Set oCONv = Server.CreateObject("ADODB.Connection") oCONv.Open "DRIVER={SQLServer};SERVER=aeneas;UID=sa;PWD=;DATABASE=paper"

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'A Web Application Example' - gili


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
sql injection
SQL Injection!

<%@ LANGUAGE="VBSCRIPT" %>

<%

Dim oCONv, oRSu

Set oCONv = Server.CreateObject("ADODB.Connection")

oCONv.Open "DRIVER={SQLServer};SERVER=aeneas;UID=sa;PWD=;DATABASE=paper"

Set oRSu = oCONv.Execute("SELECT * FROM tblUsers WHERE username = '" & Request.Querystring("UserID") & "' AND password = '" & Request.Querystring("Password") & "'")

if not oRSu.EOF then

Session("UserID") = oRSu ("username")

Response.Redirect "loginsucceeded.asp"

else

Response.Redirect "loginfailed.asp"

end if

%>

slide3
SELECT * FROM tblUsers WHERE username = 'foo' AND password = 'bar'

http://server/login.asp?userid='%20or%201=1--

SELECT * FROM tblUsers WHERE username = '' or 1=1--