Consider this code:
?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit
Will this work out?
SQL Query:
if(isset( $_GET[ 'submit' ] ) ) {
// Get input
$id = $_GET[ 'id' ];
// Check database
$query = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
$result = mysqli_query($connection, $query);
// Get results
while( $row = mysqli_fetch_assoc( $result ) ) {
// Get values
$first = $row["first_name"];
$last = $row["last_name"];
// Feedback for end user
$html .= "<pre>ID: {$id} <br>First name: {$first} & Surname: {$last}</pre>";
}
}
My Observation:
The same code snippet works well when I hard code it into the .php file i.e.
$query = "SELECT first_name, last_name FROM users WHERE user_id = '' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit';";
BUT when I send it from a form, via GET, what I get:
mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given
Let me know if I need to be more Verbose.
eval
or something similiar.