Secure password storing • www.martinstoeckli.ch • 3/12

SQL-Injection

As long as developers of a website do not explicitely pay attention, input formulars are often vulnerable to SQL-injection. How easily this can be done, shall be demonstrated with a small example.

Find the fishes
Table: users
name password
Nemo nautilus
Blackbird treasure
Moby Dick orca
Piccard submarine2012
Table: fishes
name water
Trout fresh
Shark salt
Carp fresh
Blowfish salt
SELECT name, water FROM fishes WHERE water = '?'