diff --git a/lib/core/common.py b/lib/core/common.py index 457d1b048..234c4bb20 100755 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -1564,8 +1564,12 @@ def safeStringFormat(format_, params): """ Avoids problems with inappropriate string format strings - >>> safeStringFormat('foobar%d%s', ('1', 2)) + >>> safeStringFormat('foobar%s%s', ('1', 2)) u'foobar12' + >>> safeStringFormat('foobar %d%s', ('1', 2)) + u'foobar 12' + >>> safeStringFormat('foobar=%d%s', ('1', 2)) + u'foobar=12' """ if format_.count(PAYLOAD_DELIMITER) == 2: diff --git a/tamper/unmagicquotes.py b/tamper/unmagicquotes.py index d56136f7f..8f92f5d3a 100644 --- a/tamper/unmagicquotes.py +++ b/tamper/unmagicquotes.py @@ -26,7 +26,9 @@ def tamper(payload, **kwargs): * http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string >>> tamper("1' AND 1=1") - '1%bf%27 AND 1=1-- ' + '1%bf%27 AND 1=1' + >>> tamper("1' AND '1'='1") + '1%bf%27-- ' """ retVal = payload