full-disclosure - SQL Injeciton.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200508192130.03897.requiem@praetor.org>
Date: Sat Aug 20 05:30:17 2005
From: requiem at praetor.org (Jeremy Bishop)
Subject: SQL Injeciton.

On Friday 19 August 2005 20:20, Gabbar Sing wrote:
> Hi,
>
> We have an internal web application written in PHP, in which the
> developer has got following line.

<snip>

> At first sight I though its very much vulnerible to SQL Injection,
> but I am not just able to demonstrate it. As when i send the
> character " ' " it just escapes it before sending query to db as " '
> " thus  failing my injection.

PHP has a feature known as magic quotes that can provide automatic 
escaping of quotes in user-submitted data.  I believe the configuration 
variables to look at are "magic_quotes_gpc" and "magic_quotes_sybase", 
or some variation on those; the documentation should be more revealing.

The developer may also have manually sanitized the data; I assume you 
have checked for that already?  The ideal means of handling input would 
be to have the code check whether magic quotes are enabled and to take 
appropriate action based on the result of that check.

-- 
My group's mission statement - 'You want *what* ? By *WHEN* ?'
              -- Simon Burr