After trying successful SQL injection why the result isn't getting displayed on the webpage?

Question

1. Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case.

2. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get only SQL errors on the page.

3. On executing the query directly on mysql server ie SELECT * FROM users WHERE id = '2' ORDER BY 1;--''; I get the below result that is 1 row set along with the error.

mysql> SELECT * FROM users WHERE id = '2' ORDER BY 1;--'';
+----+----------+-----------+------------------+
| id | username | password  | creditcard       |
+----+----------+-----------+------------------+
|  2 | John     | password! | 3123456769384659 |
+----+----------+-----------+------------------+
1 row in set (0.00 sec)

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--''' at line 1

---

PHP code

<?php

require_once 'login.php';
if (!isset($_GET['id']))
{
    echo <<<_END
    <pre>            <h1>WELCOME to the KINGDOM</h1>
    <form action = 'si2.php' method = 'GET'>
    id <input type = 'text' name = 'id'>

        <input type = 'submit' value = 'cl1ck M3'></pre></form>
 _END;

}

if(!get_magic_quotes_gpc())
{
    $id = stripslashes($_GET['id']);

}
$connection = mysql_connect($db_hostname,$db_username,$db_password);
if(!$connection) die ("Unable to connect with MySql " . mysql_error());

 mysql_select_db($db_database,$connection) or die('Could not connect with the database');

$query = "SELECT * FROM users WHERE id = '$id'";

$result = mysql_query($query);
if($result)
{
    $rows = mysql_num_rows($result);
}
else { echo "Could not execute the Query:  <br>" . mysql_error();}


if($rows >= 1)
    {

        for ($j=0 ; $j < $rows; ++$j)
            {
                $row = mysql_fetch_row($result);
                echo "Hello $row[1]"."<br>";
                echo "Your Credit Card Number is  $row[3]"."<br><br>";
                echo $query."<br>";
                //echo $row[3];

            }
    }           
else
{
    echo "<br><br><br>Sorry no rows/results could be fetched on query execution <br><br><br>";
    //echo $query;
}
?>

My question is why my code isn't able to fetch the row set and displaying the table entries ? And in case I want to then what changes should I try.

Answer 1

Error and Problems in your injection

The problem is that you cannot execute multiple queries with mysql_query, and as you are injecting a ; you have multiple queries. The first one is SELECT * FROM users WHERE id = '2' ORDER BY 1 and the second one is --''.

The first one is the one that gives you the actual result in the command line, and the second one gives you your error (because it's not a valid query).

Note also that your injection: 2' ORDER BY 1;--' doesn't make all that much sense. Why do you have the ;? You don't really want to execute two queries, just one. And what is the last ' supposed to do? You already took care of the leftover ' by commenting it out via -- (at least in theory).

Solution

What you want to inject is 2' ORDER BY 1--, or, if that doesn't work, try using # (url encoded as %23 if you use a browser) instead of -- as comment character to cut of the rest of the query (the '), because it does not require an additional whitespace. In some cases you could also build the query in a way that the left over ' is used, such as OR '1' = '1 (this probably doesn't work for order by though).

Answer 2

There are possibly two issues with your attempt that cause it to fail:

• Syntax for MySQL comments to the end of the line --  requires a whitespace or control character following the double-dash:

  From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.

• PHP’s mysql_query function does only allow one single statement:

  mysql_query() sends a unique query (multiple queries are not supported) […]