I've been trying to learn sql injection and tried perform on a site that we developed. Following code is sample code taken from internet. I want to know is there a way to do sql injection even on a prepared statement?
String password = request.getParameter("Encrypted_password"); // Assume the password is encrypted using MD5 String query = "SELECT password FROM user_data WHERE user_name = ? "; PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, password); ResultSet results = pstmt.executeQuery( );
Assume password is encrypted.
I haven't include complete code for both username and password. Just password.
How can I bypass this login?
My objective is to login successfully even when the password is encrypted