Search code examples
mysqlsql-injection

SQL Injection DROP TABLE not working

I need to demonstrate SQL Inject using PHP/MySQL. I want to inject a DROP TABLE query in a login form but it never works. (TRUNCATE table works fine OTOH). After I input '; drop table users; # as field input; query turns out to be 

SELECT * FROM `users` WHERE `email` = ''; DROP TABLE users; #' AND `password` LIKE '3232';

But it never works using mysql_query() function. When I copy/paste this query in PHPmyAdmin directly, it works perfectly and table gets dropped. What can be the issue?

Solution

  • This is not possible in php/MySQL as php does not support stacked queries. The moment you inject semicolon (;) it will fail.

    You can do many other much more creative exploits using sql injection in a php-mysql application though.

    1. Enumerate all databases
    2. Table Names and Column Names
    3. Values stored in tables
    4. Upload a php backdoor

    Check Out for SQL-Map as well.