I've been trying to learn sql injection and tried perform on a site that we developed. Following code is sample code taken from internet. I want to know is there a way to do sql injection even on a prepared statement?

String password = request.getParameter("Encrypted_password");       
// Assume the password is encrypted using MD5
String query = "SELECT password FROM user_data WHERE user_name = ? ";     
PreparedStatement pstmt = connection.prepareStatement( query );       
pstmt.setString( 1, password);       
ResultSet results = pstmt.executeQuery( );        

Assume password is encrypted.
I haven't include complete code for both username and password. Just password.
How can I bypass this login?
My objective is to login successfully even when the password is encrypted

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.