4 ms·
> and maybe used SQL injections Why do you need "SQL injections" if you are writing direct SQL statements in the first place?
by vog 13y ago
> and maybe used SQL injections
Why do you need "SQL injections" if you are writing direct SQL statements in the first place?
- hobs 13y agoBecause stolen is better than free. Either way, this seems interesting and I am going to check out schemaverse as well. A friend of mine is working on a TSQL based adventure game with a similar theme, I will have to link it when he releases it.
- abstrct 13y agoNever underestimate the SQL injection! There is likely some function being called somewhere that has higher permissions than your initial query. The Schemaverse has a SQL Injection trophy with no actual code path to win it. After 2 1/2 years, there are two people who have it.
- vog 13y agoI find it confusing to call this kind of attack "SQL injection", as it is much better described by "privilege escalation", isn't it?
- Dylan16807 13y agoI wouldn't say that. Elevation could be done in a myriad of ways, and injection is one of them. The question is whether you are causing a query to go wrong by feeding it specially crafted text. The only scenario without useful injection is one where you have complete and convenient root access from all input methods.
- bdg 13y agoProtip: Always name your ships with malicious attack code. If nothing else, at least you'll look like an Internet badass.