Learning ethical SQL injection with php login form

Question

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use sql injection to login. The login form is php script, the login page consists of 2 boxes: username and password. I tried adding the "'" sign at the end of password and i do get sql error, so it is probably injectable. Then I tried adding the "' OR 1=1" and "' OR 'a'=a'" at the end of the password, but with not much success. So now I need some help! Any ideas or suggestions will be helpful. The partial php login code is below:

// Sanitization is present

if (isset($_POST['user']))
{
$user = sanitizeString($_POST['user']);
$pass = sanitizeStringSQL1($_POST['pass']);

if ($user == "" || $pass == "")
$error = "Not all fields were entered<br>";

else
{
$result = queryMySQL("SELECT user,pass FROM members WHERE user='$user' AND pass='$pass'");
if ($result->num_rows == 0)

Answer 1

You're syntax is a little off in both of your attempts at this. Since you mention you're using DVWA I'll provide the source here (so that we can rule out PHP/DB errors on your side)

<?php     

if(isset($_GET['Submit'])){ 

// Retrieve data 

$id = $_GET['id']; 

$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'"; 
$result = mysql_query($getid) or die('<pre>' . mysql_error() . '</pre>' ); 

$num = mysql_numrows($result); 

$i = 0; 

while ($i < $num) { 

    $first = mysql_result($result,$i,"first_name"); 
    $last = mysql_result($result,$i,"last_name"); 

    echo '<pre>'; 
    echo 'ID: ' . $id . '<br>First name: ' . $first . '<br>Surname: ' . $last; 
    echo '</pre>'; 

    $i++; 
} 
} 
?>

The following line will trigger a successful injection:

foo' or '1' = '1

Notice that there is no tick at the beginning nor at the end of the payload. This is because (as you can see in the source) that the query itself is providing it (on both ends of $id).

In your examples of

' OR 1=1 and ' OR 'a'=a'

The first case is missing ticks all together, and the second case has an ending tick. Both will likely produce SQL syntax errors.

If you want to check your SQL syntax use an online resource such as this.