Obtaining User or Website Data: SQL-Injection

• The trick is to mess up the SQL query string.
• There are multiple vulnerabilities here.
• First, truncate the command.

  • WHERE firstName='$input_uname' and password='$hashed_pwd'";

  • Can I get something into $input_name to break the sql ?
  • Like

     Bob';#

    • The ' is to end the quotes surrounding input_name
    • The ; is to end the statement.
    • The # is a comment in some DBMS.
    • So the query becomes

      WHERE firstName='Bob';#' and password ...

    • But everything after the password is discarded.
  • I might be able to get the stored password at this point, depending on what the page does.
  • I will certainly be able to see the balance in any case.
• Another might be

   Bob' OR '1'='1';#

  • The query becomes

     WHERE firstName='Bob' OR '1'='1';# ...

  • This should allow me to select all records in the table.
• Finally I might be able to execute a second command;
  • Bob'; DROP TABLES;#'
  • Usually SQL, like C/C++ does not care about newlines.
  • So This becomes

     WHERE firstName='Bob'; DROP TABLES; #'...

  • If this is allowed the tables are gone.
  • But you could also perform an INSERT which adds a user with a known password
  • Or update the account balance.
• The last attack has mostly been eliminated by an update to the PHP sql library which only allows a single statement to be executed.
  • See the mysqli_query man page.
  • Or the unsafe multi_query