What is nvOpzp; AND 1=1 OR (<'">iKO))?

user_4335677 0
Viewed 1046

I am seeing queries to a public search box on a website several times daily:

'nvOpzp; AND 1=1 OR (<'">iKO)),

What is going on here?

sql-injection
1 Answers

It's just an attempt to see if the code will error out. Two kinds of quotes just in case the other kind is not escaped. The nonsense text to look for in the output - if it's found then likely there is a possible injections.

Possibly a test for XSS too.

This code is looking for three different flaws:

  • the data is not properly treated before use - escaped for HTML, prepared for SQL
  • the errors are shown on the screen instead of being logged
  • the adherence to the above rules is arbitrary and not mandatory

Several times a day simply because the process is mindlessly automated, a range scan. People doing that are usually called script-kiddies - knowing actually nothing they just run some premade software.

user_2855870
Related