Skip to content

Support for escaped column name(s) SQL injection #120

@stamparm

Description

@stamparm

Example:

$query = "SELECT `" . $_GET['id'] . "` FROM table"

Sample exploitation examples:

?id=id`=`id` AND 2>1 AND `id`=`id

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions