Bypassing mysql_real_escape_string's protection

Question

Some dude challenged me to sql-inject his code. He said the PHP function in the title should suffice for this case.

$var = 'my malevolent input will be in here';
$var = mysql_real_escape_string($var);

$sql = "SELECT * FROM `users` WHERE `id` = '$var'";

mysql_query($sql);

I can't seem to bypass the single-quote escaping. What should I use as a value for $var? Can I use something?

Thanks, as always

suspicious challenge. Didn't he challenge you to break into Fort Knox also? — Your Common Sense, Nov 07 '10 at 18:51
@Col my neighbour challenged me to break into his flat before he left for his holiday. Any tools or ideas? :) — Pekka, Nov 07 '10 at 18:53
Possible duplicate: http://stackoverflow.com/questions/1220182/does-mysql-real-escape-string-fully-protect-against-sql-injection — bcosca, Nov 07 '10 at 18:54

score 2 · Answer 1 · answered Nov 07 '10 at 18:38

2

While there may be esoteric exploits in certain server versions under certain conditions and such, as far as I know, using mysql_real_escape_string() in this way is generally considered safe.

answered Nov 07 '10 at 18:38

Pekka

442,112
142
972
1,088

score 2 · Accepted Answer · answered Nov 07 '10 at 18:42

2

No, using mysql_real_escape_string is considered to be safe for any input unless the character encoding is not set properly by using mysql_client_encoding.

answered Nov 07 '10 at 18:42

Gumbo

643,351
109
780
844

Do you happen to know links to specific exploit examples for a mis-set character set off the top of your head? (No need to dig, just curious) – Pekka Nov 07 '10 at 18:45
@Pekka: [Chris Shiflett’ “`addslashes()` Versus `mysql_real_escape_string()`”](http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string) has an example. – Gumbo Nov 07 '10 at 18:48

score 0 · Answer 3 · answered Mar 05 '13 at 17:36

0

You have an error in code:

$sql = "SELECT * FROM 'users' WHERE 'id' = '$var'";

Should be

$sql = "SELECT * FROM 'users' WHERE 'id' = '".$var."'";

If you a not sure if id is an integer or a string.

If you are sure that id is always an integer, then:

$sql = "SELECT * FROM 'users' WHERE 'id' = ".intval($var)

And you will be safe with mysql_real_escape_string(); ^_^

answered Mar 05 '13 at 17:36

rinchik

2,642
8
29
46

oops. haha ) was browsing saw weird code and posted.. http://www.topito.com/wp-content/uploads/2013/01/code-31.gif – rinchik Mar 05 '13 at 17:48

Bypassing mysql_real_escape_string's protection

3 Answers3