From ac5404709749c146bb6ea903950f90fed9f8c1f4 Mon Sep 17 00:00:00 2001 From: whx Date: Mon, 6 May 2024 15:22:43 +0000 Subject: [PATCH] changes inside the presentation for better understandings of the topic --- introduction-to-sql-injection/presentation.html | 9 ++++++--- introduction-to-sql-injection/sql_injection.md | 6 ++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/introduction-to-sql-injection/presentation.html b/introduction-to-sql-injection/presentation.html index fe24a07..738108f 100644 --- a/introduction-to-sql-injection/presentation.html +++ b/introduction-to-sql-injection/presentation.html @@ -139,8 +139,8 @@ class="sourceCode sql">

Number 2

-

User input is possible inside a value of type string as a part of -said SQL query.

+

User input is possible as a part of said SQL query. Input is +delimited, e.g. by ' characters.

sql_query =
   cursor.execute(
@@ -166,6 +166,7 @@ class="sourceCode sql">Close the existing string with: '
+
  • Concatenate a second query: or
    • 
 
  • Write a query that equals to True:
 1=1
    • 
 
  • End the SQL query through a comment:
@@ -178,7 +179,9 @@ class="sourceCode sql">
    SELECT * FROM users WHERE username = '' or '1' = '1' -- - AND password '%s'
    • -

    Numbers as strings is an SQLite specific thing

    +

    You can see thath the value of username has been closed by the +' character.
    +Numbers as strings is an SQLite specific thing

    diff --git a/introduction-to-sql-injection/sql_injection.md b/introduction-to-sql-injection/sql_injection.md index 173cb0c..3bd5e27 100644 --- a/introduction-to-sql-injection/sql_injection.md +++ b/introduction-to-sql-injection/sql_injection.md @@ -34,7 +34,8 @@ sql_query = ### Number 2 -User input is possible inside a value of type string as a part of said SQL query. +User input is possible as a part of said SQL query. Input is delimited, e.g. by +`'` characters. ```sql sql_query = @@ -60,6 +61,7 @@ sql_query = >``` * Close the existing string with: `'` +* Concatenate a second query: `or` * Write a query that equals to True: `1=1` * End the SQL query through a comment: `-- -` @@ -70,7 +72,7 @@ sql_query = ```SQL SELECT * FROM users WHERE username = '' or '1' = '1' -- - AND password '%s' ``` - +You can see thath the value of username has been closed by the `'` character. *Numbers as strings is an SQLite specific thing* ---