Testing query for SQL injection

Question

I have written a code in php which enables an admin to login. The password info is fetched from the table. I know it is not a good practice to write such kind of code and i should use prepared statement or mysqli_ but i just want to learn about sql query vulnerability. I just want to know how my code is vulnerable to SQL injection ? How can i bypass the password restriction. I tried inputting password = 'anything' OR 'x'='x' in the password field but it is not bypassing it. This is my code:-

if(isset($_POST["Submit"]))
{
include 'db_connect.php';   
$user=$_POST['user'];
$pass=$_POST['pass'];
$checkquery="select * from adminlogin where password='$pass' ";
$queryex= mysql_query($checkquery);
$row= mysql_fetch_array($queryex);
$checkcasepass = $row['password'];
if($user=='admin' && strcmp($checkcasepass,$pass)==0)
{
setcookie("admin",$user);
setcookie ("student", "", time() - 3600);
header("location: admin option.php");
}
else
{
echo  "Sorry User Name and Password is Wrong";
}
}

I changed my query string to this for testing purpose:-

$checkquery="select * from adminlogin where password='$pass' OR 1=1 ";

but it didn't work. Can it be due to magic quotes ? But I am using PHP 5.4.3 and magic quotes is already depreciated. I am wondering why SQL injection is not working. ?

You should use PDO if you can help it, mysql_* functions are officially deprecated. Learn about prepared statements instead, and use PDO or MySQLi. Check out this comparison and if you choose PDO, here is a good tutorial. — Brock Hensley
– Brock Hensley, Commented May 3, 2013 at 16:33
@dirt Whilst you are very correct to state this, the user specifically says they understand that and want to understand how injection works — RMcLeod
– RMcLeod, Commented May 3, 2013 at 16:43
why don't you just echo the resulting query and post it here? — Your Common Sense
– Your Common Sense, Commented May 3, 2013 at 16:48
why am i downvoted ??? I just want to understand how sql injection works. I always use PDO's in my project. — Vivek Sadh
– Vivek Sadh, Commented May 3, 2013 at 16:48

Your Common Sense · Accepted Answer · 2013-05-03 17:02:52Z

1

The way you choose to test for injection is wrong.

This code allows an injection all right, but verification code does check not number of rows found but returned value.

But again, speaking of SQL injection - it is fine with this code, injected all right.

answered May 3, 2013 at 17:02

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Vivek Sadh Over a year ago

Yup! I got it when i carefully examined the code. It is injecting but the code matches the value of the string with the column value that is fetched in the query.

RMcLeod · Accepted Answer · 2013-05-03 16:41:39Z

1

Change 'anything' OR 'x'='x' to anything' OR 'x'='x The leading ' and trailing ' are already there, in effect the query you are trying will look like

select * from adminlogin where password=''anything' OR 'x'='x''

which isn't valid SQL

answered May 3, 2013 at 16:41

RMcLeod

2,5821 gold badge22 silver badges38 bronze badges

10 Comments

Vivek Sadh Over a year ago

Getting this using var_dump :- string 'select * from adminlogin where password='anything' OR 'x'='x' ' (length=62)

Vivek Sadh Over a year ago

Getting this:- string 'select * from adminlogin where password='anything' OR 1=1' ' (length=59)

Jonast92 Over a year ago

You have to comment out the rest of the string, like I pointed out in my example. You must do anything' OR 'x'='x';--

RMcLeod Over a year ago

@Jonast92 no need to comment on for 'x' = 'x as select * from adminlogin where password='anything' OR 'x'='x' from the var_dump is valid SQL

Jonast92 Over a year ago

If he wants to ignore the password part then he must. But my bad, he's only checking with 1 input instead of 2. (only checking for password, not useername aswell).

|

Collectives™ on Stack Overflow

Testing query for SQL injection

2 Answers 2

1 Comment

10 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

10 Comments

Your Answer

Sign up or log in

Post as a guest

Related