java - MySQL Prepared Statement with a null String -


I am testing software on any application written by somebody else. When they check that the user's user name is in the and password database, they only send it that the string Check without any - I know it's already bad.

I know that it can access SQL injection. However, on one side of SQL injection, is there any other risk? It seems that the databases change in something like this after entering the semi-prepared statement in the Database Manager category.

  string s = "choose from user * where" + user;  

When I print it, then it ends like this:

Select user from user *

Do I fail in this test case and say that this program is not properly processing the input before sending it to DB, even if it is not logged in user?


Comments

Popular posts from this blog

java - org.apache.http.ProtocolException: Target host is not specified -

java - Gradle dependencies: compile project by relative path -

ruby on rails - Object doesn't support #inspect when used with .include -