Having problems with SQL injection with mysqli extension PHP

Question

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.

Now I have myself made a PHP website using mysqli extensions instead of mysql. So for example, a basic Query execution looks like:

//mysqli// $result = mysqli_query($conn, $qry); instead of $result = mysql_query($qry);

========================================================================

So I asked others and found out that without proper sanitization or separate query builders, mysqli extension is as vulnerable as mysql extension. So, the app I made is too basic. It's just querying the DB and spitting out results. It's that simple. No sanitization is done.

But executing basic payloads like '+or+1=1--+ or anything basic, gives me the error:

mysqli_error() expects exactly 1 parameter, 0 given

So I tried a lot and can't get past this error for anything I try. I simply can't execute injections with mysqli extension. Any help is highly appreciated.

Thank You.

Answer 1

You're confusing a PHP error with a database error, but not providing enough information to reliably assist you. The error message is unrelated to the PHP code snippet you posted. It appears that you have a function call to mysqli_error() without a parameter, it is supposed to be called with an argument: https://www.php.net/manual/en/mysqli.error.php. Based on your snippet I am expecting that the correct invocation should be:

mysqli_error($conn);

I expect this will just make your script error on the next wrong invocation leaving you no closer to achieving your goal. Perhaps consider using an up to date script like DVWA (http://www.dvwa.co.uk/) instead of modifying code in a language you're not familiar with.