SQL injection on INSERT

Question

The SQL Injection on INSERT as described here doesn't seem to work with MySQL. SQL injection on INSERT

When I use this statement:

INSERT INTO COMMENTS VALUES('122','$_GET[value1]');

With this as the 'value1' variable value:

'); DELETE FROM users; --

This error gets returned:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM users; --')' at line 1

What's wrong???

PS: Someone suggested me to do an SQL injection with this as variable value:

',(SELECT group_concat(table_name) FROM information_schema.tables INTO OUTFILE '/var/www/tables.txt'))-- -

But it didn't work either, and returned a syntax error.

Answer 1

Your injection turns a single SQL statement (INSERT ...) into multiple SQL statements (INSERT ...; DELETE ...).

However, the PHP mysql API does not support multiple statements in a single query. (The underlying MySQL C API must be explicitly instructed to support this functionality, which your bindings do not do.)