I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this situation with the following statement:
$result = $dbConnect->query("INSERT INTO UserTable VALUES (NULL,'$name','$email', '$userName', '1')");
I have a few questions regarding this statement (I know this is bad practice but I want to start as basic possible).
- Is it possible to inject something into this even if it's in an if statement?
- How can you escape out of this query?
- Is there a possibility to echo the whole statement so you could get more intel in the php used, meaning that the whole result query is being echo'ed due to the injected code?
- If this has a potential SQL injection situation. Are there any people dumb enough to code this way?
Thanks in advance!
$name
to'); DROP TABLE UserTable; --
.