you can't do any SQL injection in SRO, because it is an Client application... You do it in
...
Well just let me explain something : I was there as that happened... We told it to rev6, and they warned joymax. Joymax didn't toke it serious. The problem was : If you write as password a combinations of "?*_!~><^" special chars, which is not defined in the code table, you got an SQL failure... Then you could use that to make an easy SQL injection to
You have written : Select * From * : it gave you all DB
Than you have written
Select "Charname" , "ID","ServerName","PW"
From "Tablename of char, tablename of accounts, table name of servers
Where Tablename of char.AccountID = Tablename of accounts.AccountID
AND TablenameofServers.ServerID = Table Name of Chars.ServerID
then you get ID PW Server of a char in only 10 seconds...
rev6 automized it, putted it in his server and many people got hacked. Many players flamed and Joymaxa Fixed it before Legend 2 came out...
