Re: [Full-disclosure] SQL Injeciton.

[Jeremy Bishop <requiem@xxxxxxxxxxx>]

On Friday 19 August 2005 20:20, Gabbar Sing wrote:
> Hi,
>
> We have an internal web application written in PHP, in which the
> developer has got following line.

<snip>

> At first sight I though its very much vulnerible to SQL Injection,
> but I am not just able to demonstrate it. As when i send the
> character " ' " it just escapes it before sending query to db as " '
> " thus  failing my injection.

PHP has a feature known as magic quotes that can provide automatic 
escaping of quotes in user-submitted data.  I believe the configuration 
variables to look at are "magic_quotes_gpc" and "magic_quotes_sybase", 
or some variation on those; the documentation should be more revealing.

The developer may also have manually sanitized the data; I assume you 
have checked for that already?  The ideal means of handling input would 
be to have the code check whether magic quotes are enabled and to take 
appropriate action based on the result of that check.

-- 
My group's mission statement - 'You want *what* ? By *WHEN* ?'
              -- Simon Burr
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/