Basic sql injection

Question

I'm trying to learn SQL injections so I can protect myself in the future.

Here is the PHP code:

  $req = mysql_query("INSERT INTO ip_change VALUES('', '".$_SESSION['id']."', '".$_POST['raison']."')") or die(mysql_error());

And the user has full control over $_POST['raison'] content.

When i use 'hello as $_POST['raison'] value I get

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'hello')' at line 1

When i use '); DELETE * FROM tabledetest;") or die(mysql_error());-- '); DELETE * FROM tabledetest;") or die(mysql_error());-- as $_POST['raison'] value I get

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE * FROM tabledetest;") or die(mysql_error());--')' at line 1

So I don't understand why my request isn't injected and I can't delete my tabledetest table.

Any help would be appreciated.

Answer 1

It is because you didn't do proper injection!

Here is the one you have done. The auto-format will hint you:

<?php
$_SESSION['id'] = "123"; //Just assume

$req = mysql_query("INSERT INTO ip_change VALUES('', '123', ''hello')") or die(mysql_error());

It didn't properly end the statement.

For the next one:

$req = mysql_query("INSERT INTO ip_change VALUES('', '123', ''); DELETE * FROM tabledetest;") or die(mysql_error());--')") or die(mysql_error());

1. From the manual :

mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.

mysqli has support for multiple statements .

2. -- can't comment PHP code! PHP comment is // or #

Some of the links that might help you: [Similar to your question]

1. https://en.wikibooks.org/wiki/PHP_Programming/SQL_Injection_Attacks
2. http://roshanbh.com.np/2007/12/sql-injection-attack-examples-and-preventions-in-php.html
3. SQL injection test - mysql_query

Answer 2

为了防止SQL注入，您不应直接将变量注入以使用Prepared Statements查询。