#839: fix the SQL statement as this one does not express that the orderBy clause input is user input

2020-10-22 21:34:05 +02:00 · 2020-10-22 21:34:05 +02:00 · 7b8523dcab
commit 7b8523dcab
parent dac011db78
1 changed files with 2 additions and 2 deletions
--- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content13.adoc
+++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content13.adoc
@ -6,7 +6,7 @@ Answer: No it does not
 Let us take a look at the following statement:

 ----
-SELECT * FROM users ORDER BY lastname;
+"SELECT * FROM users ORDER BY " + sortColumName + ";"
 ----

 If we look at the specification of the SQL grammar the definition is as follows: