Someone has dropped a table in my database. How?

Question

In my php scripts ALL input are "filtered" with mysqli_real_escape_string in this way:

$categoryid = mysqli_real_escape_string($link, $_GET['id']); 

$query = "SELECT categories.id AS cid, categories.title AS ctitle
              FROM categories
              WHERE cid=".$categoryid.";";

$rows = mysqli_query($link, $query);
$row = mysqli_fetch_array($rows);

Someone could tell me, how did he hacked my database and dropped the "category_post" table ?

register_globals is disabled

Who knows - there's only a small snippet here. Maybe a second-level injection attack succeeded, or maybe he obtained access another way. — , Nov 17 '13 at 07:04

score 0 · Answer 1 · answered Nov 17 '13 at 07:06

0

he probably entered the next string '1'; ;

If I'm not mistaken, this php function will not prevent sql injection, it only make sure the sql string is legal and SELECT categories.id AS cid, categories.title AS ctitle FROM categories WHERE cid='-1'; SQL INJECTION STRING ; is a legal string for sql

answered Nov 17 '13 at 07:06

zion ben yacov

715
6
13

nothing happen if I put that string – xRobot Nov 17 '13 at 10:44

score 0 · Answer 2 · answered Nov 17 '13 at 07:06

Have you taken measures to ensure that sql injection is not possible? Some things you can do to prevent injection is by using mysql_real_escape_string() before the query to escape any quotes on post and get variables, or using prepared statements with mysqli or PDO instead of using mysql_query. Also as an additional safeguard, you can create a separate user for connecting to mysql that has limited access, and not allowing that user to use DROP, etc.

Someone has dropped a table in my database. How?

2 Answers2