I ran across an opportunity for SQL injection the other day in some legacy code ...

// input: email@email.com"
$email = $_POST['email'];
mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');
// output: you have an error in your syntax near " ...

// input: email@email.com'
mysql_query("SELECT * FROM users WHERE email = '".$email."' ");
// output: ...

I'm curious as to why the first example breaks with " but the second example does not break with ' ...

  • 3
    Are you sure you have the details correct, because from what I can tell neither one should work. You either end up with WHERE email="email"" or WHERE email='email'' and neither one is valid syntax. You need to comment out the end of the query. – Conor Mancone Aug 14 '19 at 20:56

On PHP you can quote strings with either single-quotes or double-quotes. They behave a bit different -variables are only interpolated inside double-quoted strings- but the only difference in this example is that when you quote the PHP string with single quotes then you can't embed single quotes, that's why they use double quotes. Similarly, when using a double-quoted string, it's simpler to use single quotes inside.

MySQL accepts both single and double quotes for strings. It would be preferable to use single quotes though, as that's the character supported by the SQL standard. See also What is the difference between single and double quotes in SQL?

(and, as you noticed, in both cases they are failing to properly escape the parameter, allowing a SQL injection)

  • It doesn't answer the question even remotely being completely irrelevant to the code posted – Your Common Sense Aug 15 '19 at 4:31
  • Sorry but your comment is wrong @Angel is answering. The question. The answer is correct and explains it. – ISMSDEV Aug 15 '19 at 4:35
  • 3
    @ISM I have an impression that you both don't understand the question which is essentially "why there is no error in the second query". – Your Common Sense Aug 15 '19 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.