The application alert()'s the query when it is incorrect, which was pretty helpf... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		tokenizerrr on Sept 11, 2015 \| parent \| context \| favorite \| on: SQL injection interactive tutorial using SQL.js The application alert()'s the query when it is incorrect, which was pretty helpful. It would have been better if the application's own queries contained all the field names instead of *, though. So you wouldn't have to guess.

jand on Sept 11, 2015 | [–]

Yes, that would be easier. I used google to find "xxxxxx".

Edit: Removed the spoiler. There is a SQLite statement showing the table outline which works just fine. Hint: pragma

inglor on Sept 12, 2015 | [–]

That's a good idea, a PR would be appreciated but I can also add this myself.

Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact