Programming Forums - SQL injection on an insert query.

Programming Forums (http://www.programmingforums.org/forumindex.php)

- Other Web Development Languages (http://www.programmingforums.org/forum40.html)

- - SQL injection on an insert query. (http://www.programmingforums.org/showthread.php?t=11694)

TCStyle

Oct 25th, 2006 5:32 PM

SQL injection on an insert query.

Firstly, this is not going to be used maliciously. It is for test purposes on a BBS that I'm coding.

How would I go about injecting an insert query? I'll use a generic code:

mysql_query("INSERT INTO data (fData, sData) VALUES('" + $fData + "', '" + $sData + "')");

Let's say the variables $fData and $sData come straight from my html forum without passing through any checks(no strip_tags() or get_magic_quotes_gpc() functions). Now, I know how to inject a select from query, but I don't know how I would inject this?

Any help is appreciated.

DaWei

Oct 25th, 2006 6:22 PM

This is borderline, regarding the forum's rules. There are a lot of places that discuss such things freely. One thing I wonder is why you wouldn't untaint or sanitize user's input? Then you would only have to test against robust code.

jsilver608

Nov 5th, 2006 7:14 PM

You can test it out by putting in ' or " and direct sql statements to see if it affects your data.

You could just put in a ' in your input fields and if you get an error back like this (then you are vulnerable):

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax' at line X"

All times are GMT -5. The time now is 11:22 PM.