I've created a test site in order to learn about SQLi and then protect against it. I may be misunderstanding how it is supposed to behave but at present I'm not getting the results I expect.
The page:
<!DOCTYPE html>
<html><body>
<h1>SQL Injection Test Site</h1>
<h2>Login Form</h2>
<form action="" method="post">
Username: <input type="text" name="username">
Password: <input type="text" name="password">
<input type="submit"></form>
<?php
$db = mysql_connect(***, ***, ***);
if(!$db){
die('Could not connect: ' . mysql_error());
}else{
mysql_select_db(***);
}
if(isset($_POST["username"]) && isset($_POST["password"])){
$username = $_POST["username"];
$password = $_POST["password"];
$result = mysql_query("SELECT * FROM customer_data
WHERE username = '$username'
AND password = '$password'");
$result = mysql_fetch_assoc($result);
//we would now process the login if details matched
echo "Logged in: " . $result['username'];
var_dump($result);
}
?>
</body></html>
The table in the database:
The input:
username: admin
password: ' OR '1'='1
My expectation is that it would find the admin user and then accept the input from the password field as '1'='1 should evaluate to true. It actually returns the result for the first entry in the table, username JBloggs. This is the bit I don't understand.
Can anyone point out a fault in the code or logic that is causing this behaviour?
