0

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.

Now I have myself made a PHP website using mysqli extensions instead of mysql. So for example, a basic Query execution looks like:

//mysqli// $result = mysqli_query($conn, $qry); instead of $result = mysql_query($qry);

========================================================================

So I asked others and found out that without proper sanitization or separate query builders, mysqli extension is as vulnerable as mysql extension. So, the app I made is too basic. It's just querying the DB and spitting out results. It's that simple. No sanitization is done.

But executing basic payloads like '+or+1=1--+ or anything basic, gives me the error:

mysqli_error() expects exactly 1 parameter, 0 given

So I tried a lot and can't get past this error for anything I try. I simply can't execute injections with mysqli extension. Any help is highly appreciated.

Thank You.

2
  • You can use mysqli_real_escape_string for SQL injection. stackoverflow.com/questions/16282103/…
    – user215422
    Jun 16, 2020 at 4:28
  • You should reveal what is in your $qry variable. This is what contains the query. Security wise you want to prepare the statement or parameterise it, to inform the library of which parameters and what type of parameters each query should receive.
    – Pedro
    Jun 16, 2020 at 7:46

1 Answer 1

1

You're confusing a PHP error with a database error, but not providing enough information to reliably assist you. The error message is unrelated to the PHP code snippet you posted. It appears that you have a function call to mysqli_error() without a parameter, it is supposed to be called with an argument: https://www.php.net/manual/en/mysqli.error.php. Based on your snippet I am expecting that the correct invocation should be:

mysqli_error($conn);

I expect this will just make your script error on the next wrong invocation leaving you no closer to achieving your goal. Perhaps consider using an up to date script like DVWA (http://www.dvwa.co.uk/) instead of modifying code in a language you're not familiar with.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .