How to demonstrate SQL Injection in this PHP and MySQL code?

Question

I'd like to note first that this is an education attempt on my own database to better understand MySQL injections to protect my own code.

I need to work out a couple of examples of how a MySQL injection can be constructed against the following code. It's a basic user login system where I'm accepting the username and password without any escaping

$user = (!empty($_POST['user'])) ? $_POST['user'] : '';
$pass = (!empty($_POST['pass'])) ? $_POST['pass'] : '';

The MySQL query then tries to find the entered username and password in my table called users, as follows:

$res = mysql_query("SELECT * from users where user='{$user}' AND pass='{$pass}'");

This is un-escaped input, and I'm trying to come up with MySQL injections to:

bypass the password knowing a legitimate user's username (one user in my users table is tester), and
an injection that would drop the users table in its entirety.

I've tried a couple of MySQL injection examples from Wikipedia, but I'm guessing the {} in my query is preventing the injection, so I would appreciate some help from those who are confident with this, and thank you to all.

please list the ones you already tried

Natrium
– Natrium

2009-10-02 09:02:14 +00:00
Commented Oct 2, 2009 at 9:02 — Natrium
– Natrium, Commented Oct 2, 2009 at 9:02

Greg · Accepted Answer · 2009-10-02 09:12:34Z

5

Something like this should do:

To log in as user "foo", set the username to "foo' -- "

This will make your query look like

$res = mysql_query("SELECT * from users where user='foo' -- ' AND pass=''");

The "-- " means the rest of the line is commented out

Not sure if this will work but try setting the username to "foo' OR (DROP TABLE users) -- "

This will make your query look like:

$res = mysql_query("SELECT * from users where user='foo' OR (DROP TABLE users) -- ' AND pass=''");

might not accept that though - I think subqueries can only SELECT.

The mysql_query function will only run one query - others would let you do this:

$res = mysql_query("SELECT * from users where user='foo'; DROP TABLE users -- ' AND pass=''");

answered Oct 2, 2009 at 9:12

Greg

323k55 gold badges378 silver badges338 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Julien Over a year ago

Multiple queries using mysql_query is unsupported as stated in the doc : mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier .

Julien · Accepted Answer · 2009-10-02 09:16:31Z

3

You will not be able to DROP the table because using mysql_query you can't send multiple queries.

answered Oct 2, 2009 at 9:16

Julien

5253 silver badges9 bronze badges

Comments

Rik Heywood · Accepted Answer · 2009-10-02 09:10:53Z

1

Here's a long list.

http://ha.ckers.org/sqlinjection/

Your code will obviously fail almost all the test as it is totally unprotected.

answered Oct 2, 2009 at 9:10

Rik Heywood

14k10 gold badges65 silver badges82 bronze badges

Comments

Jakub Hampl · Accepted Answer · 2011-04-09 06:05:27Z

1

$user = (!empty($_POST['user'])) ? $_POST['user'] : '';
$pass = (!empty($_POST['pass'])) ? $_POST['pass'] : '';

$user = mysql_real_escape_string($user);
$pass = msyql_real_escape_string($pass);

$res = mysql_query("SELECT * from users where user='{$user}' AND pass='{$pass}'");

That will protect code for you. Anyone will not be able to DROP the table.

edited Apr 9, 2011 at 6:05

Jakub Hampl

40.7k10 gold badges80 silver badges111 bronze badges

answered Apr 9, 2011 at 4:58

pradeep jangir

111 bronze badge

Comments

middus · Accepted Answer · 2009-10-02 09:11:37Z

0

{} are not the reason. It might be that php's Magic Quotes (now deprecated) protect you from rather simplistic attacks.

However, you can switch them off and then test again.

answered Oct 2, 2009 at 9:11

middus

9,1291 gold badge34 silver badges33 bronze badges

Comments

Anthony · Accepted Answer · 2009-10-02 09:56:33Z

0

Try this one out and see if it dumps the entire table:

For both username and password, I enter:

' OR 1=1 AND '}' '=

This of course assumes that I know you are using the curly brace to wrap the data values.

I'm really not sure how MySQL handles mixed logic like that, since it's not enclosed in parenthesis, so let me know if it works!

edited Oct 2, 2009 at 9:56

answered Oct 2, 2009 at 9:21

Anthony

37.2k26 gold badges103 silver badges167 bronze badges

Collectives™ on Stack Overflow

How to demonstrate SQL Injection in this PHP and MySQL code?

6 Answers 6

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related