Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>What is there to demonstrate?</p> <p>Second order SQL injection is nothing more than SQL injection, but the unsafe code isn't the first line.</p> <p>So, to demonstrate:</p> <p>1) Create a SQL injection string that would do something unwanted when executed without escaping.</p> <p>2) Store that string safely in your DB (with escaping).</p> <p>3) Let some other piece of your code FETCH that string, and use it elsewhere without escaping.</p> <p>EDIT: Added some examplecode:</p> <p>A table:</p> <pre><code>CREATE TABLE tblUsers ( userId serial PRIMARY KEY, firstName TEXT ) </code></pre> <p>Suppose you have some SAFE code like this, receiving firstname from a form:</p> <pre><code>$firstname = someEscapeFunction($_POST["firstname"]); $SQL = "INSERT INTO tblUsers (firstname) VALUES ('{$firstname }');"; someConnection-&gt;execute($SQL); </code></pre> <p>So far, so good, assuming that someEscapeFunction() does a fine job. It isn't possible to inject SQL.</p> <p>If I would send as a value for firstname the following line, you wouldn't mind:</p> <p>bla'); DELETE FROM tblUsers; //</p> <p>Now, suppose somebody on the same system wants to transport firstName from tblUsers to tblWhatever, and does that like this:</p> <pre><code>$userid = 42; $SQL = "SELECT firstname FROM tblUsers WHERE (userId={$userid})"; $RS = con-&gt;fetchAll($SQL); $firstName = $RS[0]["firstName"]; </code></pre> <p>And then inserts it into tblWhatever without escaping:</p> <pre><code>$SQL = "INSERT INTO tblWhatever (firstName) VALUES ('{$firstName}');"; </code></pre> <p>Now, if firstname contains some deletecommand it will still be executed.</p>
    singulars
    1. This table or related slice is empty.
    1. POHow do I demonstrate a Second Order SQL Injection?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USErwin Moller
    1. USErwin Moller
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COthats the problem..I'm not sure how can I store and fetch that code.Single example like storing duplicate entries in the database or anything. something more complex like fetching the database entries with a single click command?
      singulars
      1. PO
      1. USyoshifish
    2. COI added a more concrete example.
      singulars
      1. PO
      1. USErwin Moller
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload