Re:How I bypassed Cloudflare's SQL Injection filter
by staticassertion on Friday September 18, 2020 @06:57PM
(#24522669)
I wonder if it's possible to just go byte by byte, and try to parse the statement as valid SQL? If you use the same parser, or a compatible parser, to the backend DB you'd at least catch any valid SQL statements?
[ Parent
| on HN ]
Re:How I bypassed Cloudflare's SQL Injection filter
by Bnshsysjab on Friday September 18, 2020 @07:34PM
(#24522909)
What if the payload is ‘a,b’ which renders as
Select a, b from foo;