Search code examples
phpmysqlsql-injection

Hackable sql query

I was running a site I purchased that I thought was fairly unhackable. However, after having an attack, I found it was not. He informed me of the vulnerability, however my question is what user input could have been done to get all the users usernames like he did? Here is the code...

$un=$_GET['username'];
$q=$db->query("SELECT * FROM users WHERE login_name='$un' OR username='$un'");

I realize that this is highley hackable. Therefore, I changed the site over to prepared statements to prevent this from happening again. I just want to know what he could have entered to get all the users usernames.

Someone posted the script on github, you can find it here: https://github.com/sat312/Mafia-Game-Script/blob/master/checkun.php

Solution 
  • ' OR 1=1;

    In the URL:

    /yourScript.php?username=%27%20OR%201%3D1%3B

    The idea is that since data is mixed with the command, you can just finish the command with data.