I ran across some legacy code that uses
mysql_query($sql) or die(mysql_error())
Was curious and noticed that with a correctly placed
" in the email input ... I am shown output from mysql_error() as a user.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near
'"email@example.com""'at line 1
mysql_query('SELECT * FROM users WHERE users_email_address = "'.$email.'") or die(mysql_error());
I was able to crash the browser with
firstname.lastname@example.org" OR "" = ... since I'm assuming that caused an infinite loop
First part of question is ... how would I exfiltrate information with this
" condition I have found? Is there a special name for it other than SQL injection that I can read more about?
Second part of question is: The
mysql_error output seems like it could be advantageous for a wannabe intruder, but I am unaware of the depth of information it could provide.