SQL Injection using PHP multi_query to DROP TABLE

Question

I am trying to drop a table within a database using SQL injection through PHP.

The PHP code submits a form to the Database with the following command and multi_query($sql):

$sql = "INSERT INTO Student (StdNumber, FName, LName, DOB, PhoneNumber) 
VALUES ('$input1', '$input2', '$input3', '$input4', '$input5')";

So I thought, I can SQL Inject input5. So I use:

');"; $sql .= "DROP TABLE IF EXISTS Student;";-- -

This closes the previous sql statement, then I start another statement with 'sql .=' and then I comment off the rest of it with -- -

However the table isn't dropping. I am not seeing my injection command within input5 (PhoneNumber) in the database, so it is successfully closing the previous statement I would believe.

So I am not sure what is wrong, am I using multi_query incorrectly? or is my injection incorrect?

Thank you

Edit 1: Additionally, when I submit the form it accepts it and makes another entry into the database.

Need to be like:- $sql = "INSERT INTO Student (StdNumber, FName, LName, DOB, PhoneNumber) VALUES ('$input1', '$input2', '$input3', '$input4', '$input5')"; $sql .= "DROP TABLE IF EXISTS Student;"; and then use multi_query — Death-is-the-real-truth
– Death-is-the-real-truth, Commented Sep 25, 2017 at 7:26

jeroen · Accepted Answer · 2017-09-25 07:32:37Z

2

You are trying to manipulate the sql that is generated by the php, not the php itself.

So you should not add php to your 5th input:

');"; $sql .= "DROP TABLE IF EXISTS Student;";-- -

should be something like:

1234567890'); DROP TABLE IF EXISTS Student; -- the rest here will be comments in sql

answered Sep 25, 2017 at 7:32

jeroen

91.8k22 gold badges117 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Bartholomas Over a year ago

Thank you! So I get SQL like: INSERT INTO Student (StdNumber, FName, LName, DOB, PhoneNumber) VALUES ('', '', '', '', ''); DROP TABLE IF EXISTS Student; --')

jeroen Over a year ago

@Bartholomas Exactly, I just added a phone number and some comments to illustrate.

Bartholomas Over a year ago

But it still won't drop the table in the database. Would this probably be something to do with multi_query($sql) ?

jeroen Over a year ago

@Bartholomasn You should do a var_dump($sql) to make sure it is what you think it is. And try to run that for example from the mysql command line or phpMyAdmin. If that works, the problem is in the multi-query code you haven't posted.

Bartholomas Over a year ago

Ahh yes you were correct. I receive an error saying: #1217 - Cannot delete or update a parent row: a foreign key constraint fails

Collectives™ on Stack Overflow

SQL Injection using PHP multi_query to DROP TABLE

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related