I'm trying to perform an SQL injection on a dummy website created on my localhost for a security testing project.
I tried to enter the string " OR "='
into the username and password field so it should bypass it and display Login Correct - But instead it displays login failed
Any help to understand why SQL injection is not working
<?php
mysql_connect('localhost', 'root', '');
mysql_select_db('test');
if(isset($_POST['username'])&&isset($_POST['password'])){
$username =$_POST['username'];
$password = $_POST['password'];
echo $username;
echo $password;
if(!empty($username)&&!empty($password)){
$query ="SELECT id FROM users WHERE username = '$username' AND password = '$password'";
$query_run = mysql_query($query);
if(mysql_num_rows($query_run)>=1){
echo 'Login Correct';
}else{
echo 'Login Failed';
}
}
}
?>
<form action="test.php" method="POST">
Username: <input type="text" name="username">
Password: <input type="text" name="password">
<input type="submit" value="Submit">
</form>
SQL injection is a code injection technique that might destroy your database. SQL injection is one of the most common web hacking techniques. SQL injection is the placement of malicious code in SQL statements, via web page input.
SQL Injection (SQLi) is a type of an injection attack that makes it possible to execute malicious SQL statements. These statements control a database server behind a web application. Attackers can use SQL Injection vulnerabilities to bypass application security measures.
How to prevent SQL injection attacks. Avoid placing user-provided input directly into SQL statements. Prefer prepared statements and parameterized queries, which are much safer. Stored procedures are also usually safer than dynamic SQL.
Your injection string should be like this:
Username and password:
' or '1' = '1
Username (often) or password: (It depends on which one come first in the query)#
comments rest of the query.
' or '1'='1' #
For more information about SQL injection, you can check out this perfect url:
The SQL Injection Knowledge Base
Try injecting this: ' or '1' = '1' --
'1' = '1'
is always true and --
says everything after the --
is an comment and won't be checked.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With