0

So I have this query in php

SELECT a.sifra,a.slika,a.slika2,a.imeProizvoda,a.opis,b.cijena,b.cijena2
FROM proizvodi a
inner join stanje b
on a.sifra = b.sifra
WHERE a.imeProizvoda LIKE '%$search%'

I tried making sql injection with DROP TABLE proizvodi in every way i found on internet but couldn't make it work

How would someone make that query in search so my database proizvodi is deleted

Tim Biegeleisen
  • 502,043
  • 27
  • 286
  • 360
minion
  • 151
  • 7

1 Answers1

3

To avoid SQL injection in PHP, you should absolutely use prepared statements, which make it pretty much impossible to do any SQL injection. For an answer to your question, we can try the following:

$search = "'; DROP TABLE proizvodi; SELECT * FROM dual WHERE '1' LIKE '";

This would result in the following being executed:

SELECT a.sifra, a.slika, a.slika2, a.imeProizvoda, a.opis, b.cijena, b.cijena2
FROM proizvodi a
INNER JOIN stanje b
    ON a.sifra = b.sifra
WHERE a.imeProizvoda LIKE '%';
DROP TABLE proizvodi;
SELECT * FROM dual WHERE '1' LIKE '%'

The basic idea is to trip up PHP/MySQL by ending the original valid statement, and then injecting some other (malicious) statement afterwards. Note that DROP and DELETE are not the only damaging things which could happen. For example, doing a SELECT * on a customer table containing credit card numbers could be the most damaging thing to happen.

Disclaimer: I don't live in my parents' basement and spend all my time injecting websites. But, I knew enough to guess at an answer to your question.

Tim Biegeleisen
  • 502,043
  • 27
  • 286
  • 360
  • So in input i should write `'; DROP TABLE proizvodi; SELECT * FROM dual WHERE 1 LIKE ' ` ? – minion Oct 15 '18 at 08:09
  • @minion Wait...why are you doing this? If you want to protect against SQL injection, then just use PHP's prepared statements (there are a few flavors of API). If you are actually planning to inject someone, then count me out, I won't help you. – Tim Biegeleisen Oct 15 '18 at 08:11
  • Nah. I use prepared statement from day 1, but somehow i couldn't make it work in this part of the code. Maybe you can post prepared statement on LIKE '% ? %' ?? – minion Oct 15 '18 at 08:13
  • Perfect ! Thank you. Disclaimer was funny thou – minion Oct 15 '18 at 08:16