这是什么意思?

时间:2017-03-16 12:41:12

标签: web web-applications sql-injection

string query = "SELECT * 
                FROM users 
                WHERE username = "'" + username + "' 
                      AND password = '" + password + "'"; 
     

由于此查询是通过直接连接用户的输入字符串构造的,因此仅当password不包含单引号字符时,查询才会正常运行。如果用户输入

__"
joe
"
as the username and
"
example' OR 
 'a'='a
as the password, the resulting query 
becomes__

我想知道单引号字符的含义

0 个答案:

没有答案