Avoid "OR 1=1" in SQL Injections

[@meh.7539]

More of this kind of nuanced, 'teach a person how to ... safely" sort of content, please. Excellent stuff. Thank you.

[@ksboi29]

Amazing! I was throwing 1 = 1 like noones business!

[@dami-vx2215]

thanks for this

[@UsamaAli-kr2cw]

Tibirius never disappoints his viewers. Wonderful insights as always keep it up❤❤❤❤❤

[@Tib3rius]

Thanks for the kind words!

[@GamesOfficialYouTube]

​@@Tib3rius😂

[@shinris3n]

I "Learned My Lesson" a few months ago thanks to your box on THM 😅

[@EliteBuildingCompany]

Me too lol, pretty fun.

[@TCMSecurityAcademy]

Rock on!

[@Saur3n]

Name of the lab?

[@shinris3n]

@@Saur3n "Lesson Learned"

[@brandonbowman6043]

Thanks for making this easy to understand. I was hoping for a little more "angry Tibs," but I was happy with the result.

[@lowbudgetsinger8333]

very significant knowledge. thank you very much

[@M.W.777]

Thanks Man!!

[@GamesOfficialYouTube]

Great video

[@medhamid8003]

Limit 1

[@ChristopherMadison]

Aren't nearly all injection vulnerabilities countered by using parameterized queries? Hasn't that been the standard for many years now? I'm curious how often you've successfully employed SQL injection in production environments recently.

[@Tib3rius]

Developers still have to actively use parameterized queries in order for them to work. Just being a standard isn't enough (something something...nobody follows standards). In other cases, even if developers are using parameterized queries in recent code, if the application is using legacy code, SQL injections may still exist there. I found over 100 SQL injections in 2023 alone.

[@alexgreen1767]

Haha, what a rebuttal. Sudo apt install return burn.

[@PhantomWorksStudios]

Cant this be negated by using the functions that will escape special chars?? And cant we make our own function if it comes down to it to sterlize " and ' into html hex counterparts from the ascii table?

[@Tib3rius]

Are you talking about ways to mitigate SQL injection itself? If so, prepared statements are the recommended way to go rather than manually escaping / sanitizing characters.

[@iq_rasco]

name of labs ?

[@itzpo1ska245]

Im trying, really😂😅

[@Rocks_roxks9]

😂😂😂😂

[@Bacsbox]

🎉

[@Rocks_roxks9]

Great 🤩🤩

[@TCMSecurityAcademy]

Thanks 🤗

[@proxynet6520]

Does it work in real world?

[@evanottinger1672]

TLDR: yeah

[@rumanhasan27]

1st