SQL injections

Hi guys,

Just a short question. Is it posssible to SQL inject a website that gives the following error

Microsoft OLE DB Provider for SQL Server error '80040e07' 

Syntax error converting the varchar value 'undefined' to a column of data type int. 

/testtesttest.asp, line 38 

HTML:

thanks in advance

 

Depends what protection they have.

Try something like,

DROP TABLE `name`;

Code (markup):

If that throws a error like cannot find that table then yes you could easily run a sql injection. To prevent that from happening you need to make sure you escape characters and quotes.

 

i tried and I still get this error

 

That kind of error message will give out the table names etc. on some other context. You will have to validate all user inputs.