2
$query = " $sql = select * from users where id = '$id' " 

Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.

4
  • Have you tried it? It looks injectable to me, but actually trying to exploit it will tell you more reliably.
    – paj28
    Apr 9 '14 at 12:53
  • 1
    Just a note to some reviewers that breaking DVWA doesn't really apply as "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." It's a training app and meant to be broken. Cheers!
    – TildalWave
    Apr 9 '14 at 13:13
  • Try out the exploit and see what it kicks back.
    – Nathan C
    Apr 9 '14 at 13:30
  • Ya I tried and it actually executed sucessfully. Apr 17 '14 at 5:14
2

The high level is meant to be the secure implementation and should be unbreakable.

Looking at the source code you can see that there is verification that $id is a number.

if (is_numeric($id)){

        $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

Therefore it is not possible for the id parameter to be changed to anything that will break the parameter out from the data value context and into the query context.

2
  • Actually $id=3' OR '1'='1 inputs 3 as the id and breaks the query. Apr 17 '14 at 5:15
  • @wanttomasterpython The code in your version seems different than the GitHub source. This won't work with the code in my answer. Apr 17 '14 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.