0

Image the following situation:

I know(I can see) in the code that before querying to DB using an input field parameter, there is a function which escapes all chars. Pseudo code:

escape_all_chars(input_field_variable)

Is there any point of testing multiple SQL queries in the input field rather than the simplest one?

I mean is it possible to have a complex SQL injection query that can somehow pass the escape_all_chars prevention?

Note: By complex SQL query I am not talking about complex in the way of a many character long query like writing 100k symbols. I am talking about SQL query with complex logic in it.

Improve this question
3
  • 1
    sql="SELECT * FROM users WHERE id="+escape_all_chars(input_field_variable); - here you are, a terrible complex SQL injection. Commented Mar 10, 2017 at 9:48
  • 1
    The problem with "escaping" is that people do not understand what it's for and confuse it with something else. Commented Mar 10, 2017 at 9:49
  • @YourCommonSense I got what you meant. You are right, I have wrong understanding. Thanks :) Commented Mar 10, 2017 at 12:02
Load 7 more related questions Show fewer related questions

0

Reset to default

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.