Question

This is solely for understanding/educational purposes. I’m not trying to do anything illegal or break into unauthorized databases.

I’m building a site, so read a little bit about mysql injection to keep abreast of security issues.

I read about a 1=1 exploit where you can essentially set the user value to true.

Out of curiosity, i went to my university’s wifi network (which i already have access to, and typed:

' or '1'='1' --'

what im confused about and trying to understand, is that when i hit enter, it populated the username field with the same line, but added escape characters, i.e.

\' or \'1\'=\'1\' --\'

Then when i submitted that, it added quadruple the amount of escape characters, or sonmething around there.

From a perspective of pure curiosity, what does it mean when sql is doing this? Is there a vulnerability? What is the reasoning?

Answer 1

This is occurring at the application-level in PHP. The quotes in the SQL injection attempt is being escaped by the script. Either the PHP install has magic_quotes_gpc enabled or addslashes is being applied or some other escaping is occurring.

This isn’t a vulnerability.