How to delete a table with SQL injection

Question

I'm just trying to figure out something here. I'm looking into SQL injection, and I can't seem to delete this table no matter how much I try to, and I was wondering if maybe it just can't be done - may I have some examples of how this table can be deleted?

<?php

$username = trim($_POST['username']);
$cxn = mysqli_connect($a,$b,$c,$d);
if ($cxn) {

$sql = "SELECT * FROM members WHERE logins = '{$username}';";
// tried sending: '; DROP TABLE members".' doesn't work...
$result = mysqli_query($cxn,$sql)
if (!$result) { echo 'Couldn\'t be done!'; } else { echo 'Query completed!'; }

}

?>

So, how would I delete table members using SQL injection - or is it web-safe? Thanks.

Answer 1

除非您使用mysqli_multi_query ，否则MySQLi不允许多堆栈查询，因此将无法执行DELETE -ing或DROP mysqli_multi_query 。

Answer 2

How ever, this code is still very insecure.

lets say $username getst the value

$username = "' or id > '1"

it would transfer into

SELECT * FROM members WHERE logins = '' or id > '1'

Answer 3

There is a fatal misunderstanding.

SQL injection is not equal to dropping a table. The latter action is just an example, quite vivid, but not too feasible in read circumstances. But injections aren't limited to just dropping tables!

So, even if this particular kind of injection isn't possible in your particular case, it doesn't make your code "web-safe"!

Instead of caring of numerous particular ways to exploit of injection, you have to mitigate all injections at once. By means of using prepared statements