Home > database >  About SQL injection, to join the name> 1
About SQL injection, to join the name> 1

Time:09-19

Guessed all the name of the database statement:
HTTP://XXX. XXX. XXX. ABC. Asp? P=YY and (select count (*) from the master. The dbo. Sysdatabases where name> 1 the and dbid=6) & lt;> 0

Never learn SQL, basic on baidu to understand
At the back of the SQL statement every part of the basic understanding, but can't even understand together
Book explanation is that the name field is a string type, so compared with the number 1 is definitely will go wrong, then the and logical operations on the left is wrong
Dbid 1-5 is the system tables, 6 start is the user to create, but the right whether true or false, and finally the results of the brackets is false, it should be not show any record?
Pray god to help explain,

CodePudding user response:

Do have problems, unless the artificially created all the name of the database can be converted to int,
The SQL execution is error 99.9999%,

CodePudding user response:

reference 1/f, gypsy song response:
do have problems, unless the artificially created all the name of the database can be converted to int,
The SQL execution is error 99.9999%,



So I don't understand,,
Book meaning by this statement, the dbid from 6 began to accumulate to try them one by one, you can guess solution all database name

Ah, I see the contents of the book of all kinds of mistakes, I doubt if they made a mistake again, kui he is tsinghua university press,
  • Related