Tuesday, 03 May 2011 16:00
Advise the administrators of the server/service you will be testing SQL-injection. Advise them that your account will need to be unlocked or for your IP addressed to be un-banned.
1. Random SQL
Type some random SQL for the input value and see if the server returns a message
Result should be no matching rows and no error messages displayed.
2. Wildcards
Type an asterisk (*) as the input value and observe
Result should be no matching rows and no error messages displayed.
3. The Classic
Type the following: ' or 1=1-- as the input value.
Result should be no matching rows and no error messages displayed.




