Is it possible to include a PHP Function while performing SQL Injection?

Question

Consider this code:

?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit 

Will this work out?

SQL Query:

if(isset( $_GET[ 'submit' ] ) ) {
  // Get input
  $id = $_GET[ 'id' ];

  // Check database
  $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
  $result = mysqli_query($connection, $query);
  // Get results
  while( $row = mysqli_fetch_assoc( $result ) ) {
    // Get values
    $first = $row["first_name"];
    $last  = $row["last_name"];

    // Feedback for end user
    $html .= "<pre>ID: {$id} <br>First name: {$first} & Surname: {$last}</pre>";
  }
}

My Observation:

The same code snippet works well when I hard code it into the .php file i.e.

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit';";

BUT when I send it from a form, via GET, what I get:

mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given

Let me know if I need to be more Verbose.

Answer 1

You have to understand how PHP code is run on your server.
When you request index.php to the server, what will happen is that your file name index.php will be evaluated by your php engine as is nothing more nothing less.
If your page contains a SQL request, it will be submit and the result will be use by your php code.
What you want in your case is modifying the content of index.php.
What you're suggesting could work if after the request of your SQL you had something like:

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
  $result = mysqli_query($connection, $query);
 // Get results
  while( $row = mysqli_fetch_assoc( $result ) ) {
      // Get values
      eval( $row["first_name"]);

  }

The eval function is rarely use as it's very dangerous because it could allow in this case for example php code injection (which is far worse than mysql injection) in most case.
Without eval php will never consider a string as code and php engine will only execute static code contained in your php file.

I couldn't insist enough on the fact that you should never use eval. The cases where eval could be use are very specific and in most case reveals a design flaw in the code.

Answer 2

Generally, it CAN NOT be done. SQL injection only allows you to execute SQL commands. You are not directly able to use PHP.

The only way you may be able to execute PHP using SQL inejction is if the page uses eval() on un-sanitized input from DB. Few web pages will ever do this. It may be possible even if the page uses something even more rare and weird such as generating a php file to be included from DB, but this virtually never happens.

If the page uses eval on result from DB, then you just use the SQL injection to insert the code to the appropriate place in the DB (the column that is put into eval) and then visit the page that uses the eval(). Once the PHP code from the DB is passed to eval, it is executed.