Collected research
Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
The mysqljs/mysql escape function encodes values differently per JavaScript type, and an Object becomes backtick-quoted identifiers rather than a quoted string. Passing a parameter as an object through Express turns a comparison into an always-true column-to-column test, giving SQL injection and login bypass in code that correctly used placeholders or escape().
Record
- Researcher
- stypr
- Published by
- Medium
- Date
- Topic
- Injection
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of stypr, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .