The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

input, Applications frequently gather a collection of data across several

requests, and only persist this to the database once the complete set has been

gathered. In this situation, you will miss many SQL injection vulnerabilities if

you only submit crafted data within each individual request and monitor the

application’s response to that request.

String Data

When user-supplied string data is incorporated into an SQL query, it is encap-

sulated within single quotation marks. In order to exploit any SQL injection

flaw, you will need to break out of these quotation marks.

HACK STEPS

■