About SQL Injection Mysql

Question

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the fields become empty again. But when I used an apostrophe in the password field, the message says "Invalid Username/password".

What does that indicate? And if I put admin' as username (don't add comments) and in the password field, write ;Drop Table users; (don't add comment) are my comments gonna work?

Answer 1

Not enough information to tell - given this, it could simply be rejecting empty passwords, and taking any input in the password field, hashing it, then checking it against the DB safely.

Consider the following pseudocode (this is not intended to be good practice, just clear to read - do not use in production!):

if (isempty($password)) {
  reloadPage();
} else {
  $query = "SELECT * FROM users where username = :username";
  if ($user = dbquery($query, $username)){
    if (checkpassword($password, $user.password)){
      login();
    } else {
      reloadPage("Invalid Username/Password");
    }
  } else {
    reloadPage("Invalid Username/Password");
  }
}

This would give the described behaviour, without (assuming that the dbquery function makes a clear distinction between query data and user supplied parameters) allowing SQLi.

In a slight aside, using DROP TABLE in a penetration test is unlikely to go down well with the client. You should use safer methods to verify the potential flaw: get the current DB user, for example.