2009-07-09, 10:59 AM
Dusk Wrote:I don't know too much about SQL injection other than how it works (lol unescaped quotes), but Style's funny post got me thinking, is it possible to actually change values with it? Assuming complete incompetence on the programmer's part and allowing the user to access the database as a DBA for some reason. Shouldn't be possible with just select statements, right? Can't do a select * from maplestoryaccounts where user = ...DROP TABLE MAPLESTORYACCOUNTS... or anything like that, can you?escaping quotes does not fully block SQL injections. you need to escape all the SQL commands, typically with mysql_real_escape_string.
And yes, ofcourse you can drop the database. But what profit will it bring to you? they will just load a backup of the database in an hour or two.