4 ms·
shouldn't it be: '; DROP TABLE "COMPANIES";-- ? ie. end the single quote first, so that searching by the text would be: SELECT * FROM "COMPANIES" WH
by ninkendo 3y ago
shouldn't it be:
'; DROP TABLE "COMPANIES";--
?
ie. end the single quote first, so that searching by the text would be:
SELECT * FROM "COMPANIES" WHERE "NAME" = ''; DROP TABLE "COMPANIES";--'
- pxeger1 3y agoFrom https://pizzey.me/posts/no-i-didnt-try-to-break-companies-house/ https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho... The company name is a bit of hacker sleight-of-hand… or as some astute people have put it, it’s ‘wrong’. Of course it’s wrong - I’m not a /total/ arsehole. :
- deleted 3y ago[deleted]
- Zuider 3y agoAs the blog post says, most SQL databases won't accept a name given in double quotes as the name of a table.