How people can use this security hole?

Question

I have browser game. There is message send form.

I didn't make real escape string function to the "message_content" variable.

There is any option, that the user could make after the insert of the message, any update ?

I mean that the user could write a sql code in the message_content that can UPDATE values in the sql? Like update users set gold = '9999' where username = 'my_username'

THANKS ALOT.... And that it only a question. Don't worry i already made mysql_real_escape_string...

[How to prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php?rq=1) — Luigi Siri, Jun 05 '13 at 14:05

score 3 · Answer 1 · answered Jun 05 '13 at 14:07

3

Please learn about using parametrized queries, preferably with the PDO module, to protect your web app. http://bobby-tables.com/php has examples to get you started.

answered Jun 05 '13 at 14:07

Andy Lester

91,102
13
100
152

score 1 · Answer 2 · edited Jun 06 '13 at 00:00

The mysql_query function doesn't allow the execution of multiple statements at once. So the often mentioned example of Robert'; DROP TABLE Students; -- won’t work.

This also means that the exploitation is restricted to the statement type. So if the injection point is in an INSERT statement, the vulnerability can only be exploited to insert arbitrary values into that specific table.

However, one can still inject arbitrary data from the database into that table. And if the attacker addresses the message to himself, he will be able to read arbitrary data from the database and may also be able to read and write arbitrary files on the server.

score 0 · Answer 3 · answered Jun 05 '13 at 14:07

If you don't escape the user input the following can happen:

Imagine this query:

SELECT * FROM user WHERE login='$login'

where $loginis the user's input.

Now the user insers the following content in the variable: '; DROP TABLE user; --

The following query will be executed:

SELECT * FROM user WHERE login=''; DROP TABLE user; --'

It's a very generic example, but I hope you get the idea

How people can use this security hole?

3 Answers3