How to demonstrate SQL Injection in this PHP and MySQL code?

Question

I'd like to note first that this is an education attempt on my own database to better understand MySQL injections to protect my own code.

I need to work out a couple of examples of how a MySQL injection can be constructed against the following code. It's a basic user login system where I'm accepting the username and password without any escaping

$user = (!empty($_POST['user'])) ? $_POST['user'] : '';
$pass = (!empty($_POST['pass'])) ? $_POST['pass'] : '';

The MySQL query then tries to find the entered username and password in my table called users, as follows:

$res = mysql_query("SELECT * from users where user='{$user}' AND pass='{$pass}'");

This is un-escaped input, and I'm trying to come up with MySQL injections to:

1. bypass the password knowing a legitimate user's username (one user in my users table is tester), and
2. an injection that would drop the users table in its entirety.

I've tried a couple of MySQL injection examples from Wikipedia, but I'm guessing the {} in my query is preventing the injection, so I would appreciate some help from those who are confident with this, and thank you to all.

Answer 1

Something like this should do:

1. To log in as user "foo", set the username to "foo' -- "

This will make your query look like

$res = mysql_query("SELECT * from users where user='foo' -- ' AND pass=''");

The "-- " means the rest of the line is commented out

2. Not sure if this will work but try setting the username to "foo' OR (DROP TABLE users) -- "

This will make your query look like:

$res = mysql_query("SELECT * from users where user='foo' OR (DROP TABLE users) -- ' AND pass=''");

might not accept that though - I think subqueries can only SELECT.

The mysql_query function will only run one query - others would let you do this:

$res = mysql_query("SELECT * from users where user='foo'; DROP TABLE users -- ' AND pass=''"); 

Answer 2

You will not be able to DROP the table because using mysql_query you can't send multiple queries.

Answer 3

Here's a long list.

http://ha.ckers.org/sqlinjection/

Your code will obviously fail almost all the test as it is totally unprotected.