Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

sql injection help


ghost's Avatar
0 0

ok so im trying to inj sql that will give me list of emails from certain site. I found a vuln that allows me to inj sql but only certain way. i can only get a single email from user. for exsample: there is field where your sps to put where ur from(city, etc): and i sql injection it like this - "Mycity', where description=tb_users.email WHERE user='someuser' –" so, the description of user 'someuser' becomes his email. What i want is to put ALL emails in ONE user description. Any ideas? my english is bad, hope u understand what im trying to say..


ghost's Avatar
0 0

It depends on how it has been coded and whether is is a while or a simple echo once. You'd have to experiment but in some cases it wont be possible


ghost's Avatar
0 0

im not sure what are u trying to say?