SQL injection example: login bypass and UNION reads on a local API

<h1> SQL injection example: login bypass and UNION reads on a local API </h1> <p>SQL injection happens when an application pastes request data into the text of a query, so the input can change what the query means. In a small sqlite3-backed HTTP API we bypassed a login with one crafted username and read every user's password hash through a search parameter. Binding values with placeholders stopped

Read the source →