How can I test my PHP MySQL injection example?

Question

I want to use PHP/Mysql injection with a login example, my code is below.

I have tried with a username of anything' -- and an empty password but it doesn't work and I couldn't log in.

Could anyone help me?

<?php
mysql_connect('localhost','root','root');
mysql_select_db('hp');
?>

<form action="" method="post">
<table width="50%">
    <tr>
        <td>User</td>
        <td><input type="text" name="user"></td>
    </tr>
    <tr>
        <td></td>
        <td><input type="text" name="password"></td>
    </tr>
</table>
    <input type="submit" value="OK" name="s">
</form>

<?php
if($_POST['s']){
    $user = $_POST['user'];
    $pass = $_POST['password'];     
    $re = mysql_query("select * from zend_adminlist where user_name = '$user' and password = '$pass'");

    if(mysql_num_rows($re) == 0){       
        echo '0';
    }else{
        echo '1';
    }
}
?>

Lemon Drop · Accepted Answer · 2016-01-24 07:37:40Z

24

One of the most common examples is this query:

' or '1'='1

If you enter this as the username and password into some unsanitized login input the query changes like so:

Original: SELECT * FROM USERS WHERE USER='' AND PASS='';
Modified: SELECT * FROM USERS WHERE USER='' or '1'='1' AND PASS='' or '1'='1';

This causes each thing its looking for to be true, as 1 will always equal 1. Problem with this method is it does not allow the selection of a particular user. Doing so you need to make it ignore the AND statement by commenting it out as seen in other examples.

edited Jan 24, 2016 at 7:37

answered Apr 2, 2013 at 7:12

Lemon Drop

2,1332 gold badges19 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

mohitesachin217 Over a year ago

I mostly try # after the query like 1' OR 1=1# So the code after that commented out. someone also can use --

Kovge · Accepted Answer · 2013-04-02 07:22:04Z

8

If the value of username is:

 $_POST['user'] = "1' OR 1 LIMIT 1; --";

Then the mysql query becomes:

select * 
from zend_adminlist 
where user_name = '1' OR 1 LIMIT 1; --' and password = '$pass'

edited Apr 2, 2013 at 7:22

answered Apr 2, 2013 at 7:13

Kovge

2,0191 gold badge14 silver badges13 bronze badges

3 Comments

Lemon Drop Over a year ago

Doesn't mysql only allow 1 line per query?

Kovge Over a year ago

1 line , it is true but one line means one query delimiter: ; The -- means that the code after it is commented out. So actually the upper query is one query. I just breaked lines to be the code readeable.

mohitesachin217 Over a year ago

I use # instead of -- most of the time.

Collectives™ on Stack Overflow

How can I test my PHP MySQL injection example?

2 Answers 2

1 Comment

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related