0

I would like to demonstrate SQL injection using Java and sqlite. I'm attempting to execute two queries at the same time with SQL injection. The user is to prematurely end the statement using ;, then add another entry using an insert statement.

Mysql JDBC using allowMultiQueries=true in the connection string.

How can I do this using sqllite?

TIA

Jeremiah
  • 751
  • 9
  • 21
  • You say you use sqlite in the first sentence then use a Mysql JDBC - these are two separate databases - how are you using them together? – mmmmmm Mar 03 '13 at 10:44

1 Answers1

2

allowMultiQueries as a MySQL-specific connection parameter.

I do not know of any SQLite JDBC driver that would allow multiple commands in one query. Therefore, this kind of SQL injection attack is not possible. Your best bet would be to construct some query like this:

SELECT * FROM Users WHERE Name = 'admin'--' AND Password = 'whatever'

or this:

SELECT *
FROM Users
WHERE Name = 'admin'
  AND Password = 'whatever' or Name='admin'
CL.
  • 173,858
  • 17
  • 217
  • 259