Be aimed at ACCESS flaw another discovery

SQL Injection it may be said is hot nowadays, a lot of new Injection way is come out by mining. Use systematic error to explode method, it is popular topic more, today I also collect is lively.

This exemple test applies to ACCESS (because MS SQL inquiry is nonexistent,assign route) , ACEESS is put in to be able to guide the watch of source data library in target database.

Be like: Mysource.mdb(admin is expressed) , > in Mydestion.mdb

If want to be in an exterior database that has existed,found new job to express, you can use IN key word. If exterior database is nonexistent or it is the word that data table already existed, SELECT INTO statement will return a wrong message.

SELECT * INTO TblNewCustomers IN 'C:CUstomers.mdb' FROM TblCustomers.

The left and right sides pushs putting is to be able to use child inquiry function application becomes it:

Have flaw sentence commonly, be like Select * From News Where Id="&request("id") , those who be put in inject. Demonstrate below to use Select * From News Whre Id= with " &request(" Id " ) will check. To go to the lavatory, direct changeover is the condition when SQL carries out:

Select * From News Where Id=3 And SELECT * INTO TblNewCustomers IN 'C:CUstomers.mdb' FROM TblCustomers

Classics test is to cannot be in child inquiry implementation guides of the function of the watch. This road was stayed in by archives again. Abrupt between thought of UNION, amalgamative operator, look to whether can use it.

Note: The UNION Operator (applicable ACCEESS)

Although the operation of UNION also can treat an amalgamative inquiry, but we are not OK technical the ground regards it is a connection, it is mentioned to because it can synthesize the data that obtains from many origin,be in sheet of watch of a result, and the connection of this and certain type is similar. UNION operation is used to commonly combine the data that comes from statement of watch sheet, SELECT or inquiry, omit any reduplicative go. All data sources must have identical numerary region, these region are not certain nevertheless if same data kind. Let us assume we have an employee to express sheet, be had among them and the structure with identical sheet of customer industry tabulation, so we hope to incorporate the list that tabulation of these two labour gets a full name and email address information.

SELECT [Last Name] , [First Name] , email FROM TblCustomers UNION SELECT [Last Name] , [First Name] , email FROM TblEmployees

UNION operation won't show to appearing record repeats in allowing why to express sheet in two. The inquiry statement that uses UNION must be listed with the inquiry statement field before UNION equal, be like:
Previous12 Next