zzzprojects / sqlfiddle

http://sqlfiddle.com
MIT License
275 stars 52 forks source link

DML filters evasion in MySQL with comments #64

Open plushy opened 11 years ago

plushy commented 11 years ago

The filter doesn't catch statements that are followed by a comment: http://sqlfiddle.com/#!2/83fbb/19 By the way while we're at it. How about disabling nonstractional database like myisam and allowing INSERT/UPDATE/DELETE statements? Or allowing to create temporary tables? That's not on the implicit commit list (http://dev.mysql.com/doc/refman/5.6/en/implicit-commit.html).