If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify anything in the database?

When I put an apostrophe after the username there was no SQL syntax error, rather the site reloaded.

  • 1
    please do not capitalise every word – schroeder Jun 28 '18 at 17:28
  • 1
    what the effects will be are up to how the site is coded - login attempts are most certainly logged – schroeder Jun 28 '18 at 17:29
  • But i had just put an apostrophe,nothing else!that was a login page,still chance of any modifying in the database? – Rifat Jun 28 '18 at 18:21

It's very, very unlikely that it would change anything.

I think it's safe to assume that the SQL query you are injecting into is a SELECT query. Such a query does not change the content of the database, it just fetches data. If you terminated the query (e.g. with ;) and started a new INSERT or UPDATE query you could possibly change data, but it doesn't sound like you did that.

If you get no error and the site just reloads, that is probably a sign that your injection attack was detected and averted. Or that it just didn't work.

So while I don't think the SQL query you injected into changed anything, it's impossible to say anything with 100% certainty. The application could follow any arbitrary logic, and without reviewing the source code you can't really know. But let me say this: If I were you, I wouldn't be that worried about it.

  • I just put apostrophe after the username,didnt do anything after that.Only put apostrophe and the site reloaded.is there any chance of modifying of anything? – Rifat Jun 28 '18 at 17:57
  • @Rifat No, that couldnt possibly have produced a query that made changes. – Anders Jun 28 '18 at 18:51
  • would have been highly glad if you assure me fully :( – Rifat Jun 28 '18 at 19:04
  • 4
    That would be impossible to assure you fully. – jkdba Jun 28 '18 at 21:08
  • 3
    @Rifat - Before you play around with SQL-injections you should understand what you are doing, and certainly you should learn this on your own computer, not a public site! You cannot delegate responsibility to anyone but yourself. – martinstoeckli Jun 29 '18 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.