Now what I need to do is I need to type into the password something that has
a single quote in it, because then I can convince it that it's a single quote.
So here's one that's pretty good.
So I'll say csev@umich.edu.
And I'm going to say that the password is single quote,
or P single quote or single quote 1,
single quote equals single quote 1.
Now, again, it's just like when I was doing HTML entities,
I am going to put this string there and
then SQL is going to interpret the single quotes that I just sent in, okay?
And so this is not the right password, but
then when I submit it, look at the select statement.
The SELECT statement is this is what I typed.
This is the unescaped data that came from the user.
So I meant for
it to be that this was the password, but that's not how SQL is going to read it.
It's going to say this, or that's SQL, 1=1, which is always true.
So there is a record that's going to come back, and we used in the code
the existence of one record as login successful and so away we go.
So I just broke into this system by figuring out a cleverly constructed
password to get in, okay?
That's bad, that's bad.
Now I wish I could show you a little a drop table, students but
they made it so that this query right
here won't do semicolons unless you force it to do semicolons.
So the more fun thing to do is add a semi-colon in there and
do a second SQL command.
But they took away all the fun, so I can't even demonstrate that.
So I can just demonstrate cheating and
logging in without actually knowing the password.
So how do we solve this?
Well it's so easy.
The way we solve this is we use login2.php instead.
And we use PDO the way it was meant to be used.
And if I put in the P' or '1' 'p' or
1=1, it's not going to work.
And that's because the SQL that's actually sent has these placeholders in it.
It doesn't have the actual text.
We actually pass in the text to this execute.
And this execute carefully escapes as much as necessary all of these user entered
values.
It assumes anything that's being mapped in here might be dangerous.
So it's like, create a little place, don't let this data escape.
Create a little place, don't let this data escape.
If they put funky characters in there, do whatever.
It's kind of like HTML entities and before we had PDO and prepared statements,
there was a series of MySQL escape things that made the code look really nasty.
Now we just use PDO and
many languages have these things where they parametrize all their SQL.
And so the answer to this is just use PDO prepared statements.
Don't use string concatenation, especially when user entered data is present.
Never ever use string concatenation to make SQL when,
end user data is part of the query.
And end user data is inevitably going to be part of the query..
So that's why PDO Is my best friend, and
I love PDO, and I can't say enough good things about PDO.
And so that is how we do a void SQL injection, okay?
So, I hope this little code walk through was helpful.
Cheers.
[MUSIC]
