I was trying to do SQL Injection (SQLi).
My Form is:
<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
<table>
<tr>
<td>Nama Properti</td>
<td>:</td>
<td>
<input type="text" name="property_name">
</td>
<td>
<?php if(isset($errors)) echo "<p class='errlog'>" . $errors . "</p>"; ?>
</td>
</tr>
<tr>
<td></td>
<td>:</td>
<td>
<input type="submit" name="submit-form" value="Kirim" >
</td>
</tr>
</table>
</form>
And my action is:
<?php
if (isset($_POST["submit-form"])) {
if (!empty($_POST["property_name"])) {
$mysqli = new mysqli("127.0.0.1", "root", "", "belajar");
if ($mysqli->connect_errno) {
echo "Failed to connect to MySQL: " . $mysqli->connect_error;
exit();
}
$property_name = $_POST["property_name"];
echo $property_name; // produce 'x'); DROP TABLE kelas_lain;--
$sql = "INSERT INTO kelas_lain (property_name) VALUES (". $property_name .")";
echo "<br>" . $sql; // produce INSERT INTO kelas_lain (property_name) VALUES ('x'); DROP TABLE kelas_lain;--)
if ($sql_query = $mysqli->query($sql)) {
echo "<p class='successlog'>Success !</p>";
echo "Returned rows are: " . $sql_query->num_rows;
$sql_query->free_result();
}else{
echo "<p class='errlog'>There is an error with SQL !</p>";
}
$mysqli->close();
}else{
$errors = "Mohon Isi Form !";
}
}
?>
I passed this 'x'); DROP TABLE kelas_lain;-- through the input user form, but i get an error echo "<p class='errlog'>There is an error with SQL !</p>"; instead of successfully did this command INSERT INTO kelas_lain (property_name) VALUES ('x'); DROP TABLE kelas_lain;--) which would drop kelas_lain table.
I did echo $sql; it showed :
INSERT INTO kelas_lain (property_name) VALUES ('x'); DROP TABLE kelas_lain;--)
And i think all is correct.
Additional
While i have successfully done (SQLi) by passing the query through the url.
The passed query is : index.php?id=1 UNION SELECT password FROM siswalogin where id=1 This is the code :
<?php
/*
* Check if the 'id' GET variable is set
*/
if (isset($_GET['id'])){
$id = htmlspecialchars($_GET['id']);
/* Setup the connection to the database */
$mysqli = new mysqli('localhost', 'root', '', 'belajar');
/* Check connection before executing the SQL query */
if ($mysqli->connect_errno) {
printf("Connect failed: %s\n", $mysqli->connect_error);
exit();
}
/* SQL query vulnerable to SQL injection */
$sql = "SELECT username
FROM siswalogin
WHERE id = $id";
/* Select queries return a result */
if ($result = $mysqli->query($sql)) {
while($obj = $result->fetch_object()){
print($obj->username);
}
echo "<br>" . $id; // = 1 UNION SELECT password FROM siswalogin where id=1
}
/* If the database returns an error, print it to screen */
elseif($mysqli->error){
print($mysqli->error);
}
}
?>
