Geek Answers Handbook

How vulnerable is my code for SQL injection?

Well, I don't want this to be a question about hacking tips, so please don't vote for it. I work in an online store, and I found that some of our old PHP pages are vulnerable to SQL injection in the username and want to know how bad this is.

We use the PHP string to embed user input from POST into the login form.

$uname = $_POST['username']; $pass = md5($_POST['pass']); $sql = "SELECT * FROM users WHERE username='$uname' AND password='$pass' AND userlevel='user'"; ...

then I run the query.

Now, I am not an expert on SQL, I just use what I can put together on phpMyAdmin. But I was able to log in without a username, instead using:

 ' OR 1 '

I know that to avoid user input, I use mysql_real_escape_string .

My question is: how vulnerable is this code, and someone can enter this page and do not need a password? I think maybe they don’t need a username, but they can only go too far. But I'm not a SQL guru, and I'm wondering if some tricks can be used against us.

We use MySQL.

And please, I don’t need lectures on checking input, I know how bad this is. We have to do many things, such as timeouts and locks on our page, so that it cannot be rude.

+4
source share
5 answers

“Can anyone enter this page and don’t need a password”: Yes, it’s trivial. Try entering yourfavoriteadmin' OR 1; -- username yourfavoriteadmin' OR 1; -- yourfavoriteadmin' OR 1; -- .

May also relate this, because, of course, someone will ...

+10
source

Its very vulnerable. If you know about all the great things like mysql_real_escape_string , why are you wasting your time and asking this question? You should be all over this code, fixing it. You know, for example, NOW .

+9
source

Code written is not technically vulnerable. Your SQL query contains the $ username variable, but you never initialize it or set it to anything. This is a mistake and you will never get the correct result from MySQL.

However, when correcting this error, you should avoid variables with mysql_real_escape_string ().

http://us.php.net/manual/en/function.mysql-real-escape-string.php

+2
source

try where $ _POST ['username']:

 no one'; delete from users --
0
source

Always clear your data before using it in any SQL query, if you are working with PHP> = 5.2, you have Filter functions .

A simple question: why not change the order of WHERE pass = 'blabl' AND username = 'bla'? Do you have a pointer to these fields?

Another question: what is the point with this line

 $uname = $_POST['username'];

adding a variable, only for quoting / double quoting effect in concatenation? Without filtering and lack of data?

0
source

More articles:


All Articles