How can I test my PHP MySQL injection example?

Question

I want to use PHP/Mysql injection with a login example, my code is below.

I have tried with a username of anything\' -- and an empty password but it doe

Answer 1

One of the most common examples is this query:

' or '1'='1

If you enter this as the username and password into some unsanitized login input the query changes like so:

Original: SELECT * FROM USERS WHERE USER='' AND PASS='';
Modified: SELECT * FROM USERS WHERE USER='' or '1'='1' AND PASS='' or '1'='1';

This causes each thing its looking for to be true, as 1 will always equal 1. Problem with this method is it does not allow the selection of a particular user. Doing so you need to make it ignore the AND statement by commenting it out as seen in other examples.

Answer 2

If the value of username is:

 $_POST['user'] = "1' OR 1 LIMIT 1; --";

Then the mysql query becomes:

select * 
from zend_adminlist 
where user_name = '1' OR 1 LIMIT 1; --' and password = '$pass'