Uploaded image for project: 'MariaDB Connector/node.js'
  1. MariaDB Connector/node.js
  2. CONJS-368

SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES

    XMLWordPrintable

Details

    Description

      When the server session uses sql_mode=NO_BACKSLASH_ESCAPES, values are still escaped with a backslash. The server does not treat backslash as an escape character in that mode, so \' leaves the quote closing the string literal and the rest of the value is parsed as SQL.
      thanks fg0x0 for the report

      Attachments

        Activity

          People

            diego dupin Diego Dupin
            diego dupin Diego Dupin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.