3

Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters " and ', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.

  • 1
    Can you give some more details on your setup? – Tom K. Jan 19 '19 at 10:53
  • You're using string concatenation to build your queries and letting the attacker control Username and password values, right? – Artjom B. Jan 20 '19 at 9:51
  • "I'm also trying to avoid using MySQLi prepare." Why? It's there to help you so you don't have to think about regex statements. – Artjom B. Jan 20 '19 at 9:59
2

Yes.

There are other ways to get data from a database, or just do something malicious. One way of doing this is to select all the records from the database, using either SELECT * FROM TABLE users or SELECT * FROM TABLE users WHERE True and then filtering through the returned data to find the user that the attacker wanted.

Further, statements like DROP TABLE users are not caught under the double quotes system, and have pretty nasty effects.

  • I think OP meant SQL injection through string concatenation where Username and password would be attacker controllable. In that case none of your examples constitute an injection because they are still in quotes. Can you give other examples or clarify which setup you're talking about? – Artjom B. Jan 20 '19 at 9:50
  • You can just close the quotes in the injected string, add your malicious content and then reopen the string. Not easy to pull off, but something that could happen. – Teymour Aldridge Mar 25 '19 at 19:52
  • 1
    How would you close the quotes in the injected string if you cannot use " or '? That's the question – Artjom B. Mar 26 '19 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.