Skip to content

Suggested SQL injection examples #45

Description

@kumavale

I think we should reconsider the number of single quotes.

In the example below, since we don't write single quotes in the query because it's a static placeholder, the attacker would start with
I'm trying to write two single quotes, but when I show it escaped with .simulate(), there are a lot of single quotes and it's hard to see.

ConcatSQL/README.md

Lines 47 to 50 in f5fa442

let passwd = String::from("'' or 1=1; --"); // User supplied input
let query = query!("SELECT name FROM users WHERE id={id} AND passwd={passwd}");
assert_eq!(query.simulate(), "SELECT name FROM users WHERE id='42' AND passwd=''''' or 1=1; --'");

Since the sentence assumed by the attacker is "passwd='" + "' or 1=1; --" + "';".

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentation

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions