0

I am creating a simple mocking website that demonstrates SQL injection. It looks like this:

screenshot of webaapp

The back end is written in PHP.

<?php
    $query = $_GET['query']; 

    $min_length = 3;

    if(strlen($query) >= $min_length){ 

        $raw_results = mysqli_query($con, "SELECT * FROM tools
            WHERE (`name` LIKE '%$query%')");

        if($raw_results === FALSE) { 
            echo "query failed, no results available." . mysqli_error($con);
            die();
        }

        if(mysqli_num_rows($raw_results) > 0){ // if one or more rows are returned do following

            while($results = mysqli_fetch_array($raw_results)){
                echo "<p><h3>".$results['name']."</h3>".$results['price']."</p>";
            }

        }
        else{ // if there is no matching rows do following
            echo "No results";
        }

    }
    else{ // if query length is less than minimum
        echo "Minimum length is ".$min_length;
    }
?>

For this following line of code:

$raw_results = mysqli_query($con, "SELECT * FROM tools
                WHERE (`name` LIKE '%$query%')");

If I modify the code into:

    $raw_results = mysqli_query($con, "SELECT * FROM tools
        WHERE (`name` LIKE '%')");//$query%')");

As long as I provide a string that is longer than or equal to three chars, the entire data base will be displayed, which means ')");// is a valid SQL injection attack.

But when I provide ')");// as a malicous input into the search box, I got this warning message:

query failed, no results available.You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '");//%')' at line N

I am not sure why my SQL injection would fail to retrieve any data.

4

You are trying to break out of the PHP function which is not how SQL injections work. An SQL injection is not a PHP code injection and double quotes won't let escape from the PHP string.

You can only modify the PHP string that contains the SQL statement:

"SELECT * FROM tools WHERE (`name` LIKE '%$query%')"

So instead, try something like x%' or '%' = '.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.