• 0 Posts
  • 6 Comments
Joined 5 months ago
cake
Cake day: June 28th, 2025

help-circle





  • abbadon420@sh.itjust.workstomemes@lemmy.worldCVS style
    link
    fedilink
    arrow-up
    33
    ·
    edit-2
    9 days ago

    ') closes the input for the original sql statement. So the actual input would be “Robert”, but it’s not really important for this kind of attack.
    ; says that the statement is over and anything after is a new statement.
    DROP TABLE customer; is that new statement, which deletes a table with the name “customers”.
    -- is the syntax for an sql comment. It effectively makes sure that any other sql statements in the actual script get ignored, so you don’t get a compile error.

    This is an effective attack for when some programmer uses unsanitized string instertion in their sql script. In this case I could imagine a statement like: SELECT id FROM users WHERE name == {user_input}; where {user_input} is the literal, unsanitized input that you give on the website.

    Notice that in this case, the ') doesn’t do anything, but it just becomes part of the input, so that is now “') Robert”.