1

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL Injections: SQL Injection not working when I think it should, and it solved me some doubts, but now I have new doubts:

What I am trying to achieve is to bypass the login form that I have created, using SQL Injections. This is the script to check if the entered username and password belong to a user already registered (stored in the DB).

$email = $_POST['u_email'];
$password = $_POST['u_password'];

$query = "SELECT * FROM User WHERE EMAIL='$email' AND PASSWORD='$password'";
$result = $mysqli->query($query);
$counter = mysqli_num_rows($result);

echo "Counter: " . $counter . '<br>';
echo "Query: " . $query;
if($counter == 1)//Correct Login

I have to say that I am really confused about the result gotten when running the queries. I have created the following 3 examples where in each of them I insert different username and password values in the login form and the true is that I do not understand the gotten result of any of the examples, I think the results should be different.

1 Example: (abc@gmail.com is an existing email in the User table)

Input
Username: abc@gmail.com' OR '1'='1/*
Password: */

Output
Counter: 1
Query: SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1/*' AND PASSWORD='*/'

Should not the $counter variable value be 30 (30 is the number of registered users in the User table)?

When I run the following query in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1'

I get 30 rows, so why $counter value is 1 and not 30?

2 Example: (xxx is NOT an existing email in the User table)

Input
Username: xxx' OR '1'='1/*
Password: */

Output
Counter: 0
Query: SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1/*' AND PASSWORD='*/'

Should not the $counter variable value be 30 (30 is the number of registered users in the User table)?

When I run the following query in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1'

I get 30 rows, so why $counter value is 0 and not 30?

3 Example: (abc@gmail.com is an existing email in the User table)

Input
Username: abc@gmail.com/*
Password: */

Output
Counter: 0
Query: SELECT * FROM User WHERE EMAIL='abc@gmail.com/*' AND PASSWORD='*/'

Should not the $counter variable value be 1?

When I run the following query in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1'

I get 1 row, so why $counter value is 0 and not 1?

  • I am pretty sure that '/*' does not start a comment. Comments can only be started outside of quotes. – RBarryYoung Jul 8 '16 at 15:47
  • I think it does dev.mysql.com/doc/refman/5.7/en/comments.html – v8rs Jul 8 '16 at 15:51
  • There is nothing at that page that suggests that you can start a comment from within quotes. I know for a fact that neither the SQL standard nor other major DBMSs allow this and I sincerely doubt that MySQL does either. Plus that would exactly explain everyone of your results. – RBarryYoung Jul 8 '16 at 17:34
3

Example 1 & 2

This is because your query is applying this clause:

'1'='1/*'

If you have a comment character inside of your quotes the comment is not respected by the query parser, you would have to exit the quoted context first.

1 is returned as count because that's how many users have that email address.

Try this instead for example 1 (the same technique will apply to the others):

Username: abc@gmail.com' OR '1'='1'; --
Password: Whatever

This should make the query

SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1'; -- ' AND PASSWORD='Whatever'

Example 3

I'm guessing that you do not have a user with the email address abc@gmail.com/* set? Again, because of the quotes, it will be querying abc@gmail.com/* and not abc@gmail.com.

  • Can you add an example showing how to exit the quoted context first, I do not know what you mean – v8rs Jul 8 '16 at 16:18
  • Answer updated. – SilverlightFox Jul 8 '16 at 16:25
  • It makes sense but I do not know why, if I insert Username: abc@gmail.com' OR '1'='1'; -- , It is like the query is wrong because it prints Counter: and no number. If I run the query in the MySQL CLI and write --whatever it is not accepted as a comment. Instead if I write --[whitespace]whatever it works. The problem is that If I write in the form --[whitespace] it does not work. :( – v8rs Jul 8 '16 at 16:37
  • Sorry, I'd missed the whitespace from my first edit. Now updated. – SilverlightFox Jul 8 '16 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.