can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example.

function sanitizeStrXSS51($var)
global $connection;
return $connection->real_escape_string($var);

$result = queryMysql("SELECT * FROM profiles WHERE user='$user'");

if (isset($_POST['text']))
$text = sanitizeStrXSS51($_POST['text']);

if ($result->num_rows)
queryMysql("UPDATE profiles SET text='$text' where user='$user'");
else queryMysql("INSERT INTO profiles VALUES('$user', '$text')");
  • 3
    May I ask why you have chosen to entitle your SQL filtering method "sanitise string XSS 51"? It seems odd to call it XSS.
    – Polynomial
    Feb 1 '15 at 22:42
  • This code is from my local vulnerable website that I was given to play with, so I don't know why it's entitled like that.
    – Gazel
    Feb 1 '15 at 23:58

In your specific case, it's not vulnerable.

However, in a case with no quotes, it would be:

$comment_id = mysql_real_escape_string($_GET['id']);
$query = "SELECT id, title, message FROM comments WHERE id = " . $comment_id . " AND published = 1";
// ...

Since there's no quote to escape from, an attacker can simply put 1 OR 1=1 -- - to mess up the logic and return all comments. Not very security impacting, so let's look at something more interesting:

1 UNION SELECT u.id, u.username, u.password FROM users u -- -

This then becomes:

SELECT id, title, message
FROM comments
WHERE id = 1
SELECT u.id, u.username, u.password
FROM users u -- -
AND published = 1

The -- is a comment flag, which causes the rest of the query to be ignored. The single - on its own can be any character; it's just used to pad the HTTP parameter to ensure there's a space in there before the rest of the SQL. In the end, this returns the username in the title field, and the password in the message field, thus leaking your users table.

  • Thanks prompt reply. Ok so it not possible in this particular case. In another part of my vulnerable test site I was able to successfully pass sql injection with 1 or 1=1 ... as you've mentioned above, now I'm wondering if that went through, then the UNION SELECT... query may also be injectable? I'm gonna put up a new question with that part of the php code.
    – Gazel
    Feb 1 '15 at 23:59
  • Yup, if you can inject 1 or 1=1 then you can (probably) inject the union.
    – Polynomial
    Feb 2 '15 at 0:09

If you can still use the char function and ()

insert into users values(666,char(0x63)+char(0x65)…)
  • 1
    Except that won't work, due to the single quotes.
    – Polynomial
    Feb 1 '15 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.