[PEN-TEST] Hacking SQL queries ...

I have to audit a bit of code that does the following

SELECT Name FROM Users WHERE Name LIKE '%input%' ORDER BY Name

where input is the user-input. When I try the input 'test, the code
generated is

SELECT Name FROM Users WHERE Name LIKE '%''test%' ORDER BY Name

Since I'm an SQL newbie, I'd be curious to know how someone could supply
the appropriate input to do bad things on the SQL server - either in R/O or
R/W mode

If there are SQL hacking pages someplace, a link would be appreciated

Thanks,
Robin
Received on Feb 08 2001