What db is this supposed to work with? Doesn't work for me in SQL server. \' becomes part of the literal.
select test from test where test='\'';drop table test;--' Russ > -----Original Message----- > From: Tom Chiverton [mailto:[EMAIL PROTECTED] > Sent: Friday, February 22, 2008 11:48 AM > To: CF-Talk > Subject: Re: CFC protect from SQL Injection? > > On Friday 22 Feb 2008, Russ wrote: > > any so far... > > The last bits of http://www.unixwiz.net/techtips/sql-injection.html are > quite > fun i.e. > " > after input of __\'; DROP TABLE users; --__ is "protected" by doubling the > quotes, we get: > SELECT fieldlist > FROM customers > WHERE name = '\''; DROP TABLE users; --'; > " > > (I've used __ to delimit the user entered data). > > -- > Tom Chiverton > Helping to professionally administrate interactive features > on: http://thefalken.livejournal.com > > **************************************************** > > This email is sent for and on behalf of Halliwells LLP. > > Halliwells LLP is a limited liability partnership registered in England > and Wales under registered number OC307980 whose registered office address > is at Halliwells LLP, 3 Hardman Square, Spinningfields, Manchester, M3 > 3EB. A list of members is available for inspection at the registered > office. Any reference to a partner in relation to Halliwells LLP means a > member of Halliwells LLP. Regulated by The Solicitors Regulation > Authority. > > CONFIDENTIALITY > > This email is intended only for the use of the addressee named above and > may be confidential or legally privileged. If you are not the addressee > you must not read it and must not use any information contained in nor > copy it nor inform any person other than Halliwells LLP or the addressee > of its existence or contents. If you have received this email in error > please delete it and notify Halliwells LLP IT Department on 0870 365 2500. > > For more information about Halliwells LLP visit www.halliwells.com. > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;160198600;22374440;w Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:299720 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4