From dec55d52cabac80b25f99e35758b88ff4414e7ba Mon Sep 17 00:00:00 2001 From: nbaars Date: Sun, 14 Jan 2018 13:22:28 +0100 Subject: [PATCH] Replaced quotes with normal character (Version: 8.0.0.M5 Character Encoding Issues #411) --- .../lessonPlans/en/SqlInjection_content6.adoc | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6.adoc b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6.adoc index f6ac31efe..0ff4ece16 100644 --- a/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6.adoc +++ b/webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content6.adoc @@ -1,15 +1,29 @@ == Special Characters -/* */ are inline comments --- , # are line comments -'Select * from users where name = ‘admin’--and pass = ‘pass’' +[source] +---- +/* */ are inline comments +-- , # are line comments -; allows query chaining -'Select * from users; drop table users;' +Example: Select * from users where name = 'admin' --and pass = 'pass' +---- + + +[source] +---- +; allows query chaining + +Example: Select * from users; drop table users; +---- + +[source] +---- +',+,|| allows string concatenation +Char() strings without quotes + +Example: Select * from users where name = '+char(27) or 1=1 +---- -’,+,|| allows string concatenation -Char() strings without quotes -'Select * from users where name = ‘+char(27) or 1=1' == Special Statements