There is an SQL attack called Stacked Queries, this type of attack is done by adding an semicolon -> ; to terminate an SQL statement. Example:
/*Malicious user input by attacker*/
1; DELETE FROM sub
/*This example executes multiple statements*/
SELECT * FROM sub WHERE subid=1; DELETE FROM sub
Not all SQL injections attack may allow that, ...
First of all always try to minimize usage of --threads when you are facing problems and consider testing with something like --delay=1 as the service might not work normally in high load.
I started Juice with:
docker run --rm -p 3000:3000 bkimminich/juice-shop
Then when I try to login with invalid creds:
POST /rest/user/login HTTP/1.1
Some experimenting shows that double quotes signify 2 conditions comparing both against the value of the field named insertname and against the value insertname. So unlike the use of single quotes, manipulating the condition into WHERE name="name" will yield all rows, potentially allowing to bypass checks such as authentication.
tl/dr: The ability to properly escape user input once does not mean
your company will do it every time. You can't. Don't even try.
You have 2 good answers for the specific question you asked. However, I wanted to touch on some broader issues that are very important here:
Prepared statements aren't a foolproof solution to SQLi
Prepared statements are a ...
If escapeSimple behaves like mysqli_real_escape_string then there is one important caveat to be aware of:
mysqli::real_escape_string -- mysqli_real_escape_string — Escapes
special characters in a string for use in an SQL statement, taking
into account the current charset of the connection
(emphasis is mine)
So you need an active connection for this charset-...
Not sure what escapeSimple does exactly, but if it behaves like mysqli_real_escape_string then it's ok, as long as you are not using some weird character encoding or forget to set it correctly (UTF8 should be ok by default, as far as I know).
Remember that using MD5 or any other simple hashing function is considered bad practice today, and you should use ...
You show the result of SQL injection. I suppose the original query looked as follows:
$statement = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
In a normal case user enters following values:
Then the application generates following SQL:
$statement = "SELECT * FROM users ...