java - MySQL Prepared Statement with a null String -
I am testing software on any application written by somebody else. When they check that the user's user name is in the
and password
database, they only send it that the string
Check without any - I know it's already bad.
I know that it can access SQL injection. However, on one side of SQL injection, is there any other risk? It seems that the databases change in something like this after entering the semi-prepared statement in the Database Manager category.
string s = "choose from user * where" + user;
When I print it, then it ends like this:
Select user from user *
Do I fail in this test case and say that this program is not properly processing the input before sending it to DB, even if it is not logged in user?
Comments
Post a Comment