4 ms·
If they could use SQL injection to view the password reset token, then almost certainly they could do the same to set a password reset hash to whatever value th
by thaumaturgy 17y ago
If they could use SQL injection to view the password reset token, then almost certainly they could do the same to set a password reset hash to whatever value they wanted.
- ars 17y agoAt least with MySQL, it's much harder. You can only have one statement in a query. For reading you can add queries using a UNION, but I don't see any way to embed an insert in a select.