[RogueCoder]

Thank you for sharing, it was interesting (and easy) to read

Question:

Why do you people - and I mean everyone who writes about SQLi - target the URL only (using the get method)? I don't remember seeing anything about the post method (using forms for example), am I right or did I miss something?

Thanks

The answer to that question is probably simplicity. But I do understand why you maybe are a little frustrated about that But the thing is that, what you do in the GET request you do in the POST request as well. So it's identical approach except that you write the queries in the form field instead. In the end sql injection is the same no matter where you use it.

I hope that maybe answered your question

@Ex094

[Ligeti]

I asked because I learned SQLi using forms mainly, and tje tools I use to pentest also use only a form (sql inject me plugin)... I can't say that the methods are the same ... But you are the expert :-)

Thanks.

[Ligeti]

@fahadhassen, don't say that out loud! Not good for you reputation...

[chmod]

-snip-

20. Illegal Content is not allowed. We remove it as quickly as possible however we will not be held liable for any such content.

This includes hacking requests, just as a court of law we don't care what your reasons are a crime is a crime, we will not help you commit it.

[ASDASOD]

i got one site has this error
"Wrong QueryYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''69''' at line 1"

But when trying to use order by method no error appeared??
I used order by 1 to 1000
and order by 1-- to 1000--
Have you any solution???

[756dk]

This post is the reason why i like Spartans.

Very well explained.

[hhrk]

Try Sqligods.com

[hhrk]

Try Sqligods.com