first, let me show you the succesfull authentcation from clearBox clint tool using users that I've created from ClearBox server itself.
The status will change to 'FAILED' if I key in users that are not created in ClearBox.
The same method is used to authenticate users that are created from external SQL server except that you need to key some queries in in the setting as shown below.
Here are the queries that I've tried so far :
SELECT password FROM Users WHERE username= $u ;
SELECT password FROM Users WHERE username= '".$u."'"
SELECT password FROM Users WHERE username= $u
SELECT password FROM Users WHERE username='%$u%';
"SELECT password FROM Users WHERE username ='$u'"
$sql = "SELECT password FROM Users WHERE username = '$u'";
SELECT password FROM Users WHERE username LIKE '$u' ;
SELECT password FROM Users WHERE username LIKE '%u%';
But, none of them work so far. From the response packet, it keep on displaying no such user. In case you are wondering whether the SQL server is connected to my AAA server or not, the screenshot is as shown below to prove you that it is connected.
And below is a screenshot of my database table which contain 2 variables only currently.
So, please do assist me in configuring the query as I have no SQL background at all. But, I'm learning it slowly.
Thanks in advance
I saw this link on #sqlhelp. In case you haven't received your answer, you need to use LIKE instead of = in your queries. I don't know what your data looks like, but if you're looking for any username with a u in it, the query would be:
ReplyDeleteSELECT password FROM Users WHERE username LIKE '%u%';
You use LIKE with wildcards when you don't want an exact match. Here is a link to the LIKE syntax.
http://msdn.microsoft.com/en-us/library/ms179859.aspx
looks like you are using powershell to create and execute your query. if so the below script may get you on your way. you may not need the sql authentication credentials. you may want to ensure in table Users that column username in constrainted as unique:
ReplyDelete$username = "User1"
#trap sql injection
if (-not($username.Contains("'"))) {
#query to find exact match username
$sql = "SELECT password FROM dbo.Users WHERE username = '" + $username + "';"
Invoke-Sqlcmd -ServerInstance MyServer\MyInstance -Database MyDatabase -Username MySqlLogin -Password MySqlPassword -Query $sql
}
to Anonymous:
ReplyDeleteWhere do I key in that query? in the SQL database server or ClearBox?
I don't really understand your explaination.
lol
Hello all,I am new and I would like to ask that what are the benefits of sql training, what all topics should be covered and it is kinda bothering me ... and has anyone studies from this course wiziq.com/course/125-comprehensive-introduction-to-sql of SQL tutorial online?? or tell me any other guidance...
ReplyDeletewould really appreciate help... and Also i would like to thank for all the information you are providing on sql.
SQL is important. You don't have to study from that link. There are many other websites that teaches SQL.
Delete