2 ms·
You can just try out some || concated strings and an or statement to verify the lack of security. It's not like it's a secret how to do SQL injections in 2024.
by cookiengineer 3y ago
You can just try out some || concated strings and an or statement to verify the lack of security. It's not like it's a secret how to do SQL injections in 2024.
Bypassing this kind of filter is literally the second picoCTF SQL injection level, which is intended for high school STEM students.
- berkes 3y agoYrs. But you presume that these password rules are there for security. I'm saying they are there because some part of the stack is stupid. I'm quite certain you cannot breach security like that, but that some (ancient) piece of the stack has some hardwired rules, which, at some point, might indeed be a "defence against injection". But this is no proof that this is still the case.