Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database.

We prepared our VM's with PHP with disabled magic quotes to allow this kind of abuse. Otherwise, this would not work. We also have very old version of phpBB from 2005.

SELECT user_id, username, user_password, user_active, user_level,
user_login_tries, user_last_login_try
FROM USERS_TABLE
WHERE username = ’$username’ AND user_password = ’md5($password)’;

We can log into the phpBB site by using this command in login.php username field: admin'# or admin';--.

But when I try to insert an additional account to the database by following code I'm not able to add or modify any information in database:

admin';INSERT INTO users_table(user_id,username,user_password)     
VALUES('100','user',.md5('pass'))#

Now, why am I NOT able to add/update/delete any accounts? I have a brief idea why, but I'm not 100% sure. I'm not asking how to make it work, but rather why this wouldn't work.

share|improve this question
    
I think that PHP allows only one MySQL query at a time. –  TRiG Sep 18 '13 at 1:37
    
@TRiG is right but this depends on your database engine. For example, MySQL doesn't allow this to be done. –  Simon Sep 18 '13 at 1:45
add comment

marked as duplicate by Adnan, TildalWave, Xander, lynks, Rory Alsop Sep 18 '13 at 18:35

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 2 down vote accepted

Is this MySQL specific? As others have noted in the comments, the standard MySQL extension in PHP does not support stacked queries. Stacked queries allow you to use semi-colons(';') to separate SQL statements in a single query. This type of functionality is only supported in the mysqli and PDO extensions of PHP.

From the PHP Documentation:

mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.)

The documentation explicitly states that multiple queries are not supported, so fortunately (unfortunately?) only one statement can be executed at a time.

Also take a look at this question, as it seems to be similar to yours.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.