CODEWITHSUNDEEP
mysql
user3154836
user3154836

Reputation: 13

SQL insert query inside select or where clause

Maybe my question above may be could be stupid , but I just want to know if is it possible to have insert query inside select or where.

The reason that I want to know that is if someone hack website or any application database, can the hacker input data to hacked database without my knowledge ?

the following example of SQL injection I see in other sites

http://www.example.com/empsummary.php?id=1 AND 1=-1 union select 1,group_concat(name,0x3a,email,0x3a,phone,0x2a),3,4,5,6,7,8,9 from employee

I know what exactly that above query does, but can the hacker input (use insert query) on the database or on any table ?

Upvotes: 0

Views: 423

Answers (1)

spencer7593
spencer7593

Reputation: 108430

Yes, it can happen, if the database interface is configured to allow multiple statements in a query.

An INSERT can't run as part of a SELECT statement. But it's possible that the exploit of a vulnerability could finish a SELECT and then execute a separate insert.

Say you have a vulnerable statement like this:

 SELECT foo FROM bar WHERE fee = '$var'

Consider the SQL text when $var contains:

 1'; INSERT INTO emp (id) VALUES (999); --

The SQL text could be something like this:

 SELECT foo FROM bar WHERE fee = '1'; INSERT INTO emp (id) VALUES (999); --'

If multi-statement queries are enabled in the database interface library, it's conceivable that an INSERT statement could be executed.

See: https://www.owasp.org/index.php/SQL_Injection

Upvotes: 1

Related Questions