0

I have the following PHP Code and I am not able to pass the authentication using a SQL Injection. Do you have any ideas how to do it?

$password=md5($_REQUEST['dr']);
$result=mysql_query("SELECT dr FROM table WHERE user='".$username."'");
if (mysql_fetch_object($result)->dr==$password) {
            $okay=true;
}

closed as off-topic by Steve, S.L. Barth, grochmal, HashHazard, Matthew Nov 16 '16 at 9:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Steve, S.L. Barth, HashHazard, Matthew
If this question can be reworded to fit the rules in the help center, please edit the question.

2

There is a SQL Injection obviously on $username parameter, but you can't bypass login, because the password is compared with the result of the query, for example, if you inject ' or 1=1 --, the query will be:

SELECT dr FROM table WHERE user='' or 1=1 -- 

But this doesn't mean you can access to the application, the following line code shows how the result of the query is compared with the parameter dr:

if (mysql_fetch_object($result)->dr==$password) {
            $okay=true;
}

This is part of the best prractices about login based on SQL queries; compare username and password independently.

I hope this information helps you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.