From 74cca6d1852dac67fda613f620bac62df517586d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eskil=20Andr=C3=A9en?= Date: Thu, 19 Nov 2020 07:45:07 +0100 Subject: [PATCH] Add missing trailing double quote in sql query (#897) --- .../lessonPlans/en/SqlInjection_introduction_content8.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_introduction_content8.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_introduction_content8.adoc index bfea14d64..094f4c6e1 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_introduction_content8.adoc +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_introduction_content8.adoc @@ -22,5 +22,5 @@ Since you always have the urge to be the most earning employee, you want to expl Use the form below and try to retrieve all employee data from the *employees* table. You should not need to know any specific names or TANs to get the information you need. + You already found out that the query performing your request looks like this: ------------------------------------------------------------ -"SELECT * FROM employees WHERE last_name = '" + name + "' AND auth_tan = '" + auth_tan + "'; +"SELECT * FROM employees WHERE last_name = '" + name + "' AND auth_tan = '" + auth_tan + "'"; ------------------------------------------------------------