1

I am using wamp server and MYSQL . I have designed a login page and connected to database that stores username and password .If SQL Injection happens in login page then a alert mail need to be sent to admin. But I am getting mail even if the user logged in correctly and also if SQL Injection happens. Loginpage.html

<!DOCTYPE html>
 <html lang="en" dir="ltr">
<head>
<meta charset="UTF-8">
<title>Login form </title>
 <link rel="stylesheet" type="text/css" href="style1.css">
 </head>
 <body>
     <div class="box">
     <form  action="insert.php" method="POST">
         <h1>Login</h1>
         <input type="text" name="username" placeholder="name">
         <input type="text" name="password" placeholder="Password">
         <input type="submit" name="submit" value="Login">
     </form>
    </div>
     </body>
 </html>

insert.php

<?php
if(isset($_POST['submit'])){ 
    $conn = mysqli_connect('localhost:3308','root', '')or die("connection error");
    mysqli_select_db($conn,"sqllogin");
$username =$_POST["username"];
$password=$_POST["password"];
$query="SELECT * FROM users WHERE username='$username' AND password='$password'";
    $result=mysqli_query($conn,$query);
    $count = mysqli_num_rows($result);

if($count > 0)
    {
    require 'PHPMailer/PHPMailerAutoload.php';
    $mail = new PHPMailer;

//$mail->SMTPDebug = 4;                               // Enable verbose debug output

$mail->isSMTP();                                      // Set mailer to use SMTP
$mail->Host = 'smtp.gmail.com';  // Specify main and backup SMTP servers
$mail->SMTPAuth = true;                               // Enable SMTP authentication
$mail->Username = 'user@gmail.com';                 // SMTP username
$mail->Password = 'secret';                           // SMTP password
$mail->SMTPSecure = 'tls';                            // Enable TLS encryption, `ssl` also accepted
$mail->Port = 587;                                    // TCP port to connect to

$mail->setFrom('user@gmail.com', 'user');
$mail->addAddress('admin@gmail.com');     // Add a recipient
//$mail->addAddress('ellen@example.com');               // Name is optional
//$mail->addReplyTo('info@example.com', 'Information');
//$mail->addCC('cc@example.com');
//$mail->addBCC('bcc@example.com');

//$mail->addAttachment('/var/tmp/file.tar.gz');         // Add attachments
//$mail->addAttachment('/tmp/image.jpg', 'new.jpg');    // Optional name
$mail->isHTML(true);                                  // Set email format to HTML

$mail->Subject = 'ALERT MAIL';
$mail->Body    = 'Your website is hacked';
//$mail->AltBody = 'This is the body in plain text for non-HTML mail clients';
header("Location:indexbook.html");

if(!$mail->send()) {

    echo 'Message could not be sent.';
    echo 'Mailer Error: ' . $mail->ErrorInfo;
} else {
    
    echo"<h1> success</h1>";
    echo 'Message has been sent';
}
}
}
?>
ahens
  • 19
  • 3
  • 1
    Considering the code has a constant SQL injection that seems fitting. But could you explain how it’s supposed to detect this sql injection and email you about it? – Sami Kuhmonen Feb 27 '21 at 06:54
  • 1
    Your code is open to SQL injection! Fix that before doing anything! [Use PDO and parameters](https://stackoverflow.com/a/60496/6089612). – Don't Panic Feb 27 '21 at 12:23
  • @Don'tPanic actually I am learning about SQL injection so for learning purpose I designed a login page and it works but my doubt is how to sent alert mail to admin whenever the SQL injection happens? – ahens Feb 27 '21 at 13:13
  • To avoid sql injection you can use mysqli_real_escape_string(connection,variable), I have an idea, maybe to detect if an sql injection is being made you can check the variable given as a parameter to that function and the return result of that function.If the variable used and the return value of the function are different then maybe an sql injection is begin made. Hope this help!! – Charbelalam Feb 27 '21 at 14:08

0 Answers0