First time posting on Security Stack but I have benefited a lot from previous posts. I am currently a security cyber security grad student and I am building up my thesis project right now: it is effectively another vulnerable web application suite (like DVWA or WebGoat) but focuses heavily on teaching the back-end of these attacks and providing more hands-on examples--along with hopefully updated and more relevant kinds of attacks based on things like the OWASP top 10 for 2017.

For the sake of time and my thesis I am just going to build section covering injection attacks (as it seems like that is some of the most common and devastating kinds of web-based attacks). The rest will come on my own time. Anyway, here is my question:

It seems that we are in a shift about how vulnerable we actually are. Right now I am building my application in PHP and MySQL, and it seems like the shift to MySQLi has really solved a lot of the appending-based SQL injections. Meaning that injections like:

mysqli_query("SELECT email, passwd, login_id, full_name FROM members WHERE email = 'x'; DROP TABLE members; --'");

don't really work, as the updated mysqli_query() only allows for a single SQL statement to be passed at any give time, and if more are attempted then the function returns false. Developers would specifically have to use the mysqli_multi_query() type for that to happen--and that does not seem likely for simple login forms.

So right now I have a simple application that will display a table row based on the user supplying a correct username and password:

    // Prevent errors from showing
    // Connect the db
    require '../../connect_db.php';

    if (isset($_POST['UserName'], $_POST['UserPass'] ) ) {

        // Grab user Input
        $UserName = $_POST['UserName'];
        $UserPass = $_POST['UserPass'];

        // The passwords in this case are stored in the clear. This is an early example. 
        // BINARY is used to force matching case. 
        $query = "SELECT * FROM users WHERE UserName='".$UserName."' AND BINARY UserPass='".$UserPass."'";

        $result = mysqli_query($db, $query)
         or die("Error: " . mysqli_error($db));

        // Echo out the table row(s)
        while($row = mysqli_fetch_array($result)) {
            echo '<tr class="query-result">'; // Class is added so that jQuery can remove old ones
            echo '<td>' . $row['UserId'] . '</td>';
            echo '<td>' . $row['UserName'] . '</td>';
            echo '<td>' . $row['UserPass'] . '</td>';
            echo '<td>' . $row['UserRole'] . '</td>';
            echo '</tr>';

I know that, as written that this attack is vulnerable to the '' OR '=' injection--but for the above code what other kinds of injection attacks might happen? It really seems like most well-known injection attacks really relied upon the ability to UNION or in some way to stack SQL commands--assuming that developers are using the updated MySQLi syntax, what other kinds of injection attacks are worth preparing for? And can we effectively not worry about the 'stacked-based' injection attacks?

I would love any and all resources that you can throw at me, as I am hoping to be able to share this with the greater security community.

  • Do you have a question? Right now, your post is completely open-ended and looking for collections of resources, which is not a good fit for StackExchange sites. – schroeder Aug 28 '17 at 8:59

Your question is quite broad, but I think it can be boiled down to:

Have SQL Injections changed with PHPs change from mysql to mysqli (because of missing stacked query support)

The answer: No, they haven't. mysql also does not support stacked queries.

Regarding the limitations of not having stacked queries: Apart from UNION-based injections, you still have error based and blind injections with subqueries, which don't necessarily require UNION (see eg here; there are other bypasses in case UNION is actually filtered out, but that's another question). You are stuck with the type of query you are in (SELECT, UPDATE, DELETE, etc), but apart from that, you have a lot of possibilities (but again, this seems like another question).

Not the answer you're looking for? Browse other questions tagged or ask your own question.