CODEWITHSUNDEEP
phpmysqlsqlsql-injection
Shubham Gupta
Shubham Gupta

Reputation: 227

why not this SQL injection working?

I am trying to inject the script given below and i am giving something like -

userid="abcd" and pid="'; drop table shubh //"

but it is not deleting the table. and i have seen many answers on stackoverflow everyone is using these comments "--" but as per PHP Manual comments are these "//,#,/* */"

i am referring to this resource -- http://www.w3resource.com/sql/sql-injection/sql-injection.php

    <?php
 $host="localhost";
 $username="root";
 $password="";
 $db_name="hr";
 $con=mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
 mysql_select_db("$db_name")or die("cannot select DB");
 $uid = $_POST['uid'];
 $pid = $_POST['passid'];
 $sql = "select * from user_details where userid = '".$uid."' and password = '".$pid."'";
 //$sql = "select * from user_details where userid = '".shubham."'";//shubham"' drop table shubh";//.$uid."' and password = '".$pid."'";
echo $sql;
 $result = mysql_query($sql);
 if(mysql_num_rows($result)>0)
 {echo "<h4>"."-- Personal Information -- "."</h4>","</br>";
 while ($row=mysql_fetch_row($result))
 {echo "<p>"."User ID    :  ".$row[1]."</p>";
 echo "<p>"."Password   :  ".$row[2]."</p>";
 echo "<p>"."First Name :  ".$row[3]." Last Name  :  ".$row[4]."</p>";
 echo "<p>"."Gender     :  ".$row[5]." Date of Birth :".$row[6]."</p>";
 echo "<p>"."Country  :  ".$row[7]." User rating :  ".$row[8]."</p>";
 echo "<p>"."Email ID :  ".$row[9]."</p>";
 echo "--------------------------------------------";
 }
 }
 else
 echo "Invalid user id or password";
 ?>

Upvotes: 0

Views: 116

Answers (1)

Quentin
Quentin

Reputation: 943564

userid="abcd" and pid="'; drop table shubh //"

but it is not deleting the table.

mysql_query only accepts a single statement.

SQL injection via that function needs to use a different approach (such as subqueries).

i have seen many answers on stackoverflow everyone is using these comments "--" but as per PHP Manual comments are these "//,#,/* */"

SQL is not PHP. It has a different comment syntax.

Upvotes: 3

Related Questions