Re: SQL Injection Basics

Right, I wasn't thinking too well... makes sense. Though, according to quite a few SQL injection faqs I have read, it said that you could only inject code if the developer used tick marks. However, I just recently used SQL injection on some code where the developer used NO tick marks, but injection still worked if the injection string contained TWO tick marks. Was this just a fluke, or is it something that the faqs had wrong?

Nick J.
nick@ethicsdesign.com

• Original Message ----- From: "Dennis Hurst" <dhurst@spidynamics.com> To: "'Nick Jacobsen'" <nick@ethicsdesign.com> Cc: <webappsec@securityfocus.com> Sent: Monday, February 10, 2003 8:59 AM Subject: RE: SQL Injection Basics

> Nick,
Received on Mon Feb 10 16:57:34 2003