Search code examples
sqldatabasesql-injection

Is there some way to inject SQL even if the ' character is deleted?

If I remove all the ' characters from a SQL query, is there some other way to do a SQL injection attack on the database?

How can it be done? Can anyone give me examples?

Solution

  • Yes, there is. An excerpt from Wikipedia

    "SELECT * FROM data WHERE id = " + a_variable + ";"

    It is clear from this statement that the author intended a_variable to be a number correlating to the "id" field. However, if it is in fact a string then the end user may manipulate the statement as they choose, thereby bypassing the need for escape characters. For example, setting a_variable to

    1;DROP TABLE users

    will drop (delete) the "users" table from the database, since the SQL would be rendered as follows:

    SELECT * FROM DATA WHERE id=1;DROP TABLE users;

    SQL injection is not a simple attack to fight. I would do very careful research if I were you.