gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-12-12 07:40:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

SQL injection - Fix linting errors

Browse Source
This commit is contained in:
Swissky
2025-08-13 12:07:35 +02:00
parent b10a11041c
commit cc670aa544
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Encoding Transformations/README.md
View File

@@ -106,4 +106,6 @@ admin
* [Puny-Code, 0-Click Account Takeover - Voorivex - June 1, 2025](https://blog.voorivex.team/puny-code-0-click-account-takeover) * [Puny-Code, 0-Click Account Takeover - Voorivex - June 1, 2025](https://blog.voorivex.team/puny-code-0-click-account-takeover)
* [Unicode normalization vulnerabilities - Lazar - September 30, 2021](https://lazarv.com/posts/unicode-normalization-vulnerabilities/) * [Unicode normalization vulnerabilities - Lazar - September 30, 2021](https://lazarv.com/posts/unicode-normalization-vulnerabilities/)
* [Unicode Normalization Vulnerabilities & the Special K Polyglot - AppCheck - September 2, 2019](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/)
* [WAF Bypassing with Unicode Compatibility - Jorge Lajara - February 19, 2020](https://jlajara.gitlab.io/Bypass_WAF_Unicode) * [WAF Bypassing with Unicode Compatibility - Jorge Lajara - February 19, 2020](https://jlajara.gitlab.io/Bypass_WAF_Unicode)
* [When "Zoë" !== "Zoë". Or why you need to normalize Unicode strings - Alessandro Segala - March 11, 2019](https://withblue.ink/2019/03/11/why-you-need-to-normalize-unicode-strings.html)

11
SQL Injection/README.md
View File

@@ -361,24 +361,24 @@ Second Order SQL Injection is a subtype of SQL injection where the malicious SQL
Unlike first-order SQLi, the injection doesn’t happen right away. It is **triggered in a separate step**, often in a different part of the application. Unlike first-order SQLi, the injection doesn’t happen right away. It is **triggered in a separate step**, often in a different part of the application.
1. User submits input that is stored (e.g., during registration or profile update). 1. User submits input that is stored (e.g., during registration or profile update).
```text ```text
Username: attacker'-- Username: attacker'--
Email: attacker@example.com Email: attacker@example.com
``` ```
2. That input is saved **without validation** but doesn't trigger a SQL injection. 2. That input is saved **without validation** but doesn't trigger a SQL injection.
```sql ```sql
INSERT INTO users (username, email) VALUES ('attacker\'--', 'attacker@example.com'); INSERT INTO users (username, email) VALUES ('attacker\'--', 'attacker@example.com');
``` ```
3. Later, the application retrieves and uses the stored data in a SQL query. 3. Later, the application retrieves and uses the stored data in a SQL query.
```python ```python
query = "SELECT * FROM logs WHERE username = '" + user_from_db + "'" query = "SELECT * FROM logs WHERE username = '" + user_from_db + "'"
``` ```
4. If this query is built unsafely, the injection is triggered. 4. If this query is built unsafely, the injection is triggered.
## PDO Prepared Statements ## PDO Prepared Statements
@@ -453,6 +453,7 @@ PDO allows for binding of input parameters, which ensures that user data is prop
``` ```
## Generic WAF Bypass ## Generic WAF Bypass
--- ---
### No Space Allowed ### No Space Allowed