Can someone explain me why this code:

$sql='select * from admin where user_name="$user" and password="$pass" ' ;  

$re = mysql_query($sql);  

is not vulnerable (payload: "or 1=1-- ) while this code:

$sql="select * from admin where user_name='$user' and password='$pass' " ;

$re = mysql_query($sql);

is vulnerable (payload: 'or 1=1-- ) ?

I only alternate single quotes with double quotes.
System: FreeBSD 10.2-RELEASE
MySql: mysql Ver 14.14 Distrib 5.6.24, for FreeBSD10.1 (i386) using EditLine wrapper



In PHP variables will not expanded inside single quotes (see http://php.net/manual/en/language.types.string.php) so that when the whole string is included in single quotes it will not be affected by your SQLi example. That means the following statement would be sent to the SQL server:

select * from admin where user_name="$user" and password="$pass"

This is probably not what you would expect, because you expected that the variables get expanded, i.e. something like this:

select * from admin where user_name="some-user-name" and password="some-password"

To make the variables expand in the string you must use double quotes around the string in PHP, like you did in your other example. But then you are vulnerable to SQLi like you noticed.

For information on how to properly protect against SQLi see http://bobby-tables.com/.

  • so when you have single quotes in php, this will create something like the prepared statements? Thanks for your answer. – Dimopoulos Elias Nov 19 '15 at 10:52
  • 3
    @DimopoulosElias: no, when you have single quotes in PHP it will simply not expand the variables. This has nothing to do with prepared statements. – Steffen Ullrich Nov 19 '15 at 11:17
  • Now i understand what you are saying. Ok ok, thank you very much. – Dimopoulos Elias Nov 19 '15 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.