3

Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters " and ', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.

2

Yes.

There are other ways to get data from a database, or just do something malicious. One way of doing this is to select all the records from the database, using either SELECT * FROM TABLE users or SELECT * FROM TABLE users WHERE True and then filtering through the returned data to find the user that the attacker wanted.

Further, statements like DROP TABLE users are not caught under the double quotes system, and have pretty nasty effects.

  • I think OP meant SQL injection through string concatenation where Username and password would be attacker controllable. In that case none of your examples constitute an injection because they are still in quotes. Can you give other examples or clarify which setup you're talking about? – Artjom B. Jan 20 at 9:50
  • You can just close the quotes in the injected string, add your malicious content and then reopen the string. Not easy to pull off, but something that could happen. – Teymour Aldridge Mar 25 at 19:52
  • 1
    How would you close the quotes in the injected string if you cannot use " or '? That's the question – Artjom B. Mar 26 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.