php mysql sql injection execute delete

Question

If there is a query via a php script which is vulnerable like

select email from mytable where id = $_REQUEST['id']

Is there a risk that someone can execute a truncate table etc using sql vulnerability.

This query is executed using mysql_query(). Multi queries are not allowed.

I understand that this is a vulnerable code. What I want to know is if someone can execute a delete or truncate. I want to know the extent of the vulnerability

possible duplicate of [How can I prevent SQL-injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Ben Fortune, Nov 04 '14 at 11:35
yes, thera are vulnerabities. you need to escape your variables. — vaso123, Nov 04 '14 at 11:35

score 1 · Answer 1 · answered Nov 04 '14 at 11:37

1

sure if you let user to fill the "id" freely.

for example:

$_REQUEST['id'] = 123; delete from mytable where 1; select email from mytable where id = 123; delete from mytable where 1;

and if you use multi_query() then the second query will be executed.

answered Nov 04 '14 at 11:37

Frederick Zhang

3,593
4
32
54

I am using mysql_query() for the execution. Multi queries are not allowed – Ram Nov 04 '14 at 12:59

score 0 · Answer 2 · answered Nov 04 '14 at 11:39

Yes, this is not a correct way to execute queries. Lets check this following example of simple SQL Injection

<?php
// We didn't check $_POST['password'], it could be anything the user wanted! For example:
$_POST['username'] = 'aidan';
$_POST['password'] = "' OR ''='";

// Query database to check if there are any matching users
$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND   password='{$_POST['password']}'";
mysql_query($query);

// This means the query sent to MySQL would be:
echo $query;
?>

The query sent to MySQL

SELECT * FROM users WHERE user='aidan' AND password='' OR ''=''

Always use mysql_real_escape_string()

baao · Answer 3 · 2014-11-04T12:40:51.497

Your query is very vulnerable to sql injection.

Use prepared statements and parameterized queries.

Using mysqli_, the right way to do is like this:

$stmt = $connection->prepare('SELECT email FROM mytable WHERE id = ?');

$stmt->bind_param('s', $_REQUEST['id']);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do whatever you need with $row
}

You can also use prepared statements with PDO

php mysql sql injection execute delete

3 Answers3