0

Let's say I have this SQL statement:

stmt.executeUpdate("INSERT INTO TUNEUSER (USERNAME,PASSWORD,BALANCE) VALUES ('"
        + daf.getString("username")
        + "','"
        + daf.getString("password")
        + "',0.00)");

and the application has a username and password field.

How can SQL injection be used to increased the balance from "0.00" to whatever you want?

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Willyfromnc
  • 19
  • 3
  • By injecting code to modify that SQL statement. Do you understand what SQL injection is and how it works? – David Feb 10 '16 at 18:58

1 Answers1

1

Set the password to something like this:

mypassword', 1000); --
Olivier De Meulder
  • 2,493
  • 3
  • 25
  • 30