2
$query = " $sql = select * from users where id = '$id' " 

Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.

4
  • Have you tried it? It looks injectable to me, but actually trying to exploit it will tell you more reliably.
    – paj28
    Apr 9, 2014 at 12:53
  • 1
    Just a note to some reviewers that breaking DVWA doesn't really apply as "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." It's a training app and meant to be broken. Cheers!
    – TildalWave
    Apr 9, 2014 at 13:13
  • Try out the exploit and see what it kicks back.
    – Nathan C
    Apr 9, 2014 at 13:30
  • Ya I tried and it actually executed sucessfully. Apr 17, 2014 at 5:14

1 Answer 1

2

The high level is meant to be the secure implementation and should be unbreakable.

Looking at the source code you can see that there is verification that $id is a number.

if (is_numeric($id)){

        $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

Therefore it is not possible for the id parameter to be changed to anything that will break the parameter out from the data value context and into the query context.

2
  • Actually $id=3' OR '1'='1 inputs 3 as the id and breaks the query. Apr 17, 2014 at 5:15
  • @wanttomasterpython The code in your version seems different than the GitHub source. This won't work with the code in my answer. Apr 17, 2014 at 6:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .