Home/ Questions/Q 3850844
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T17:04:19+00:00

I’m still learning about SQL injection, but always the best way for me was

  • 0

I’m still learning about SQL injection, but always the best way for me was using examples, so this is part of my code:

$sql = "INSERT INTO `comments` (`id`, `idpost`, `comment`, `datetime`, `author`, `active`) 
        VALUES (NULL, '" . addslashes($_POST['idcomment']) . "', '" . 
        addslashes($_POST['comment']) . "', NOW(), '" . 
        addslashes($_POST['name']) . "', '1');";

  mysql_query($sql);

Knowing that all the POST vars are entered by the user, can you show me how can i make an injection to this script? so i can understand more about this vulnerability. Thanks!

my database server is MySQL.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Most of the other answers seem to have missed the point of this question entirely.

    That said, based on your example above (and despite your code not following the best practice use of mysql_real_escape_string()) it is beyond my ability to inject anything truly detrimental when you make use of addslashes().

    However, if you were to omit it, a user could enter a string into the name field that looks something like:

    some name'; DROP TABLE comments; --

    The goal is to end the current statement, and then execute your own. -- is a comment and is used to make sure nothing that would normally come after the injected string is processed.

    However (again), it is my understanding that MySQL by default automatically closes the DB connection at the end of a single statement’s execution. So even if I did get so far as to try and drop a table, MySQL would cause that second statement to fail.

    But this isn’t the only type of SQL injection, I would suggest reading up some more on the topic. My research turned up this document from dev.mysql.com which is pretty good: http://dev.mysql.com/tech-resources/articles/guide-to-php-security-ch3.pdf

    Edit, another thought:

    Depending on what happens to the data once it goes to the database, I may not want to inject any SQL at all. I may want to inject some HTML/JavaScript that gets run when you post the data back out to a webpage in a Cross-Site Scripting (XSS) attack. Which is also something to be aware of.

    • 0