0

I am learning mysql now and one of the subjects it touches is the security issue when dealing with user input - one concern is the injection attack. I tried to duplicate the attack the book demonstrated like add a query $query = "select * from temp_table; drop table temp_table, which I used mysqli_query($connection,$query). Nothing happen. I changed to use mysqli_multi_query() and found it executed both statements. Finally I found that mysqli_query only runs one query each time.

my question is, if I use mysqli_query, theoretically speaking, the system shouldn't be worried on additional statement injection attack? Or, there is still any other way that the users can run additional statement even the server is using mysqli_query?

Dharman
  • 30,962
  • 25
  • 85
  • 135
ming
  • 19
  • 2
  • "the system shouldn't be worried on additional statement injection attack?" --- that's correct. That's the very reason the comic about the "little bobby tables" is utopic. – zerkms Apr 23 '17 at 03:06
  • Please read this answer: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – Andy Lester Apr 23 '17 at 04:23

1 Answers1

3

It's true that the basic mysqli_query() will only run one statement. So you don't have to worry that an SQL injection attack will trick your application into running multiple statements.

But one statement can include a subquery, or a SELECT... UNION SELECT....

One statement can read data it isn't intended to read. Or cause a huge sort that is intended to overwhelm your server as a denial-of-service attack.

Or it can simply be an error, not a malicious attack at all.

SELECT * FROM Users WHERE last_name = 'O'Reilly'; -- woops!

The solutions to SQL injection are pretty simple, and easy to follow. I don't understand why so many developers look for excuses not to write safe code.

Bill Karwin
  • 538,548
  • 86
  • 673
  • 828
  • You can also create problems when your statement is `select * from users where loginID = 'blah' and password = 'blah'` and the user enters `blah' or 1=1` – Nigel Ren Apr 23 '17 at 07:41