I'm trying to understand how a website can be hacked through using
addslashes in PHP and MySQL for educational purpose.
So I manually execute a query for setting Character Set.
set character set 'gbk';
The character for this purpose must be
뼧 that is
bf27.According what they say in the above topics it must be convert to something like
bf5c27 but when I test it in my lab with a PHP code like this :
$query = "SELECT first_name, last_name FROM users WHERE user_id = '".addslashes($id)."';"; echo $query; $result = mysql_query($query) or die( '<pre>' . mysql_error() . '</pre>' );
And when I insert
뼧 in my text field the exact query that executes is :
SELECT first_name, last_name FROM users WHERE user_id = '뼧';
So it seems that nothing specially happened !
After this I try to build another PHP script to understand what is going on so I build a simple script without any MySQL execution (test.php) like :
<html> <head> <title>PHP Test</title> </head> <body> <?php $command = $_REQUEST[ 'id' ];; $output = addslashes($command); echo "<pre>$output</pre>"; ?> </body> </html>
Then I execute the file with URL like :
And if you see the above PHP code it echos:
The hex code of above 3 character is:
eb bc a7
Well I just think about what happened,
My questions are :
ë¼§that it showed me ?(It seemed something unusual because it doesn't contain anything like
Why the first script doesn't show something like above three character in
How can I perform it truly like they describe(In above 2 topics) ?
Update 1 : Thanks to what Goktay Kaykusuz says I understand that I have problem in my encoding. the POC for it is I test it on Terminal and it resaluts :
<html> <head> <title>PHP Test</title> </head> <body> <pre>뼧</pre> </body> </html>
so I understand that it converts the result to UTF8 (in Chrome) but in Terminal works normally.
But the problem is still alive because it works without any wonderful bypassing (It is just what a simple string should be.)