2009-07-09, 09:08 AM
I don't know too much about SQL injection other than how it works (lol unescaped quotes), but Style's funny post got me thinking, is it possible to actually change values with it? Assuming complete incompetence on the programmer's part and allowing the user to access the database as a DBA for some reason. Shouldn't be possible with just select statements, right? Can't do a select * from maplestoryaccounts where user = ...DROP TABLE MAPLESTORYACCOUNTS... or anything like that, can you?