Home page logo

webappsec logo WebApp Sec mailing list archives

SQL Injection and MSSQL
From: "lipe!" <lipe () brturbo com>
Date: Sat, 26 Jun 2004 07:14:08 -0300

Hi all,

With filters like "if the parameter has substring 'SELECT'" a malicious user
can mask the 'select' from a request in ASP?

I mean something like (that i know witch works in MySQL)

MS SQL Server has anyway to mascarade the querys, like some unicode feature
or string functions?

I just need to know if theres anyway that i can put a select in a query
without typing explicit "select". If there, why?

Many thanks!

Felipe Santos Andrade <lipe () brturbo com>
Desenvolvedor TI/WEB Framework .NET

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]