Re: Rainbow tables anyone?
No, it doesn't mean that. It's more like peering through an unfrosted window to see a door's key code written on the wall.
For a long long time, huge numbers of websites accepted a user's login on a form that is used to compute a crappy SQL command. e.g.
"SELECT TOP 1 * FROM [Users] WHERE [User] = ' " + $User + " ' AND password=' " + $Password + " ' "
which, if jbloggs 1234 is entered, maps to a string
SELECT TOP 1 * FROM [Users] WHERE [User] = 'jbloggs' AND password = '1234'
But what happens if someone, instead of typing jbloggs, types ' OR 1=1 ;
A crap website will, from this, construct a SQL command:
SELECT TOP 1 * FROM [Users] WHERE [User] = '' OR 1=1; AND password = '1234'
which will successfully find the first user in its [USERS] table, regardless.
Oops.
Decent websites won't do things this way, and certainly those that engage in penetration testing. But I daresay there are still quite a few around that are exposed to SQL injection of this kind.