From: nummish (nummish@gmail.com)
Date: Mon Jul 05 2004 - 10:44:38 EDT
I don't have a solution for you, but part of the problem you are
facing is that you don't seem to be testing against a SQL Server
database.
afaik MS Access (gathering that from the ODBC Error message) doesn't
support comments in Jet SQL. This means # or -- aren't going to get
you further than the syntax error you keep seeing.
Another thing, since you are trying to exploit a MS Access database,
you aren't going to have any luck reading the SysObjects table. MS
Access uses a MSysObjects table instead.
Good luck with the remainder of the test.
On Sat, 3 Jul 2004 07:45:36 -0700 (PDT), Strcpy <elite_netbios@yahoo.com> wrote:
> I tried to pass it by useing # or -- or ')'=')' at the
> end of my query strings , but non worked :/
> A') select name from sysobjects where xtype='U'--
>
> [Microsoft][ODBC Microsoft Access Driver] Syntax
> error. in query expression 'city_name='Tehran' and
> (agency_english ='A') select name from sysobjects
> where xtype='U'--')'
- nummish
-- Bigger 1:23 0x90.org
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:57 EDT