Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case.
On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get only SQL errors on the page.
On executing the query directly on mysql server ie SELECT * FROM users WHERE id = '2' ORDER BY 1;--''; I get the below result that is 1 row set along with the error.
mysql> SELECT * FROM users WHERE id = '2' ORDER BY 1;--''; +----+----------+-----------+------------------+ | id | username | password | creditcard | +----+----------+-----------+------------------+ | 2 | John | password! | 3123456769384659 | +----+----------+-----------+------------------+ 1 row in set (0.00 sec)
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--''' at line 1
PHP code
<?php
require_once 'login.php';
if (!isset($_GET['id']))
{
echo <<<_END
<pre> <h1>WELCOME to the KINGDOM</h1>
<form action = 'si2.php' method = 'GET'>
id <input type = 'text' name = 'id'>
<input type = 'submit' value = 'cl1ck M3'></pre></form>
_END;
}
if(!get_magic_quotes_gpc())
{
$id = stripslashes($_GET['id']);
}
$connection = mysql_connect($db_hostname,$db_username,$db_password);
if(!$connection) die ("Unable to connect with MySql " . mysql_error());
mysql_select_db($db_database,$connection) or die('Could not connect with the database');
$query = "SELECT * FROM users WHERE id = '$id'";
$result = mysql_query($query);
if($result)
{
$rows = mysql_num_rows($result);
}
else { echo "Could not execute the Query: <br>" . mysql_error();}
if($rows >= 1)
{
for ($j=0 ; $j < $rows; ++$j)
{
$row = mysql_fetch_row($result);
echo "Hello $row[1]"."<br>";
echo "Your Credit Card Number is $row[3]"."<br><br>";
echo $query."<br>";
//echo $row[3];
}
}
else
{
echo "<br><br><br>Sorry no rows/results could be fetched on query execution <br><br><br>";
//echo $query;
}
?>
My question is why my code isn't able to fetch the row set and displaying the table entries ? And in case I want to then what changes should I try.
Aucun commentaire:
Enregistrer un commentaire