Today my friend asking help to test and prevent his website from sql injection..

After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed..

But After i tried chr(0xbf) . chr(0x27) . ' OR username = username #' on its username and password login form it showing error:

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given

Is it can be vuln to inject with SQL Injection method?

Cause after i try with SQLMap it say does not seem to be injectable.

closed as too broad by schroeder Oct 4 '18 at 10:10

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Am I taking it right that you were trying to inject a PHP code? – Your Common Sense Aug 23 '18 at 11:40
  • Yes, exactly... – Jafran J S Aug 23 '18 at 11:45
  • What do you need chr(0xbf) and chr(0x27) for? Do you get any error if you don't concatenate those two characters with the SQL code? – fbid Aug 23 '18 at 20:01

If a friend asks you to look into his site just tell him to hand you the code in question. It will be much easier to see than to test and a lot more reliable.

  • But i have to proof that error can be injectable.. I must have proof i can see its database.. – Jafran J S Aug 23 '18 at 11:56
  • 5
    Which will be a lot easier for you with a white-box approach. Take a look at the code in question, try to understand what happens with the payload you mentioned and debug it when sending your potentially malicious payload. Then you can still craft an exploit that alters the DB if your friend insists. – SeeYouInDisneyland Aug 23 '18 at 12:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.