SQL Injection

We can bypass the login page by simply adding ' or 1=1 -- or ') or 1=1 to the login id and place any value in the password field. See example below.

Figure 15

If there are no maximum number of characters defined on the TextBox, the attacker can append the SQL statement mentioned above to the form input's value. Let's say we have a page to update the comment and I update the comment with the value shown below. We should see a new entry in the tbl_SQLInjection table after the update.

Listing 27

'; DECLARE @S VARCHAR(500) SET @s= 
CAST(0x4946204f424a4543545f4944282774626c5f53514c496e6a656374696f6e272c27552729204
953204e554c4c20435245415445205441424c452064626f2e5b74626c5f53514c496e6a656374696f6
e5d285b4f75747075745d205b766172636861725d2835303029204e554c4c2920494e5345525420494
e544f2064626f2e74626c5f53514c496e6a656374696f6e2053454c454354202770616765202d20537
5626a65637420746f2053514c20496e6a656374696f6e27 as VARCHAR(500))Exec(@s)--

Next, I'll demonstrate a simple way an attacker can update every column in the table with the same value. Let's update the Name value with hacked ';--

Figure 16

Retrieve all the rows from the MyComments table and witness that all the value in name column were updated to "hacked". As mentioned earlier, the two consecutive hyphens "--" indicates the SQL comments, the query statement after the hyphens will not evaluated by the SQL server. Please make sure to backup the database before replicating this demonstration. 

Figure 17