License plate SQL injection, would it work?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

kloa posted:

I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.
code:
SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;
If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

How come the ' OR 1=1; wouldn't read?

# ¿ Apr 30, 2014 15:49

Adbot: ADBOT LOVES YOU

# ¿ May 21, 2024 22:31

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

stuxracer posted:

It would read, but would return every record from the table since 1=1.

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

# ¿ Apr 30, 2014 18:11

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?