Need help with sql implementation

Question

First off, I'm not trying to hack or do anything illegal. I thought I know what you know. I have a client who wants me to make some changes to my system when I look at it. I notice that NOTHING has slipped away. I'm not joking, nothing is slipping away. I explained to him that it is unstable to have such a system. Then he continues to tell me that he had had such a system for several years, and nothing happened. I need to show him that his system is unsafe, but I really don’t know how to perform SQL injection. Here are a few queries that use $ _GET and are not escaped.

SELECT *,DATE_FORMAT(joined,'%M %d, %Y') as \"Joined\" FROM `members` WHERE `name` LIKE '".$ltr."%' ORDER BY points DESC LIMIT $page,50 

Here's another one:

 SELECT * FROM groups WHERE id=$thisladder[grid] 

The only thing I can see is that $ _GET can be cleared by this function:

 if (!ini_get('register_globals')) { $superglobals = array($_SERVER, $_ENV, $_FILES, $_COOKIE, $_POST, $_GET); if (isset($_SESSION)) { array_unshift($superglobals, $_SESSION); } foreach ($superglobals as $superglobal) { extract($superglobal, EXTR_SKIP); } } 

It is possible that the above function may sanitize variables. And yes, the system also uses register global variables, which is also bad.

I also made a backup just in case.

Answer 1

I can not say this better than http://xkcd.com/327/ .

But then again, as Marc B says, forget the SQL injection, register_globals much, much worse. I never thought that I actually see that it is emulated, just in case.

Answer 2

Some fun things to show your "friend" how stupid his code is:

 http://example.com/badscript.php?_GET[]=ha+ha+I+pwned+your+GET+superglobal http://example.com/badscript.php?_SESSION[issuperuser]=1 

It's kind of EXACT , because register_globals is such a blatant idiotic idea, and (after the FAR is too long) was finally made OFF by default.

Forgotten SQL Injection - This idiotic piece of code allows remote embedding of a PHP variable.

Answer 3

if the login code looked something like this:

 $query = 'SELECT id FROM users WHERE username=\''.$_POST['username'].'\' AND password=\''.$_POST[password].'\''; $result = mysql_query($query); etc, etc... 

try entering this in the input fields

 username = "whatever" password = "' OR 1" 

has the meaning?