Function TestCommonSQLInjections

interpolate_test.go:160–178

Attempts to test common SQL injection strings. See `InjectionAttempts` for more information on the source and the strings themselves.

(t *testing.T)

// Attempts to test common SQL injection strings. See `InjectionAttempts` for
// more information on the source and the strings themselves.
func TestCommonSQLInjections(t *testing.T) {
	for _, sess := range testSession {
		reset(t, sess)

		for _, injectionAttempt := range strings.Split(injectionAttempts, "\n") {
			// Create a user with the attempted injection as the email address
			_, err := sess.InsertInto("dbr_people").
				Pair("name", injectionAttempt).
				Exec()
			require.NoError(t, err)

			// SELECT the name back and ensure it's equal to the injection attempt
			var name string
			err = sess.Select("name").From("dbr_people").OrderDesc("id").Limit(1).LoadOne(&name)
			require.NoError(t, err)
			require.Equal(t, injectionAttempt, name)
		}
	}
}

// InjectionAttempts is a newline separated list of common SQL injection exploits
// taken from https://wfuzz.googlecode.com/svn/trunk/wordlist/Injections/SQL.txt