Okay.
So let's increase the security level to the high security, which is fairly secure.
So sometimes it can be bypassed, sometimes it can't be bypassed.
And in this lecture, I'm actually just going to highlight something for you.
So let's try and use the same exploit that we were using before.
So if we copy this and we're going to turn on our interceptor and just I'm going to put a normal username
and password for this now.
And then we're going to intercept it here and modify it like we did in the previous video.
Okay.
Now we're going to forward it.
And as you can see, it's telling us there is a bad username and password.
So obviously this is more secure.
And actually, in this particular case, in this page, this it is not injectable anymore with this
security level, it doesn't implement the best security practice.
But for this specific case, it's secure enough.
So I'm going to have we're going to have a quick look at it, but it's not the best way to secure your
website.
So we're going to talk about the security part at the end of the section and we're going to talk about
the best way to secure yourself against SQL injections.
But for now, this is noteworthy to see because it's a quick implementation.
And if you know what you're doing, you can fix your problem quickly.
Say, for example, if you had a problem and you don't have enough time to change the implementation
to the most secure way which we're going to talk about later, then you can just do it this way quickly,
just so that you are secure enough until you can implement it and change the code to be more secure.
So what they're doing in this page now, this doesn't always secure you 100% again, but it is in this
particular case, it is secure.
So this is the code for the login.
And right here we have the case one which is the arrogant or the security level one, and here we have
the code for security level five.
So you can compare the two codes.
The main the main difference is this select statement.
So I'm going to delete everything and I'm just going to keep these two select statements so we can compare
them.
Okay.
So you can see here in the not very secure statement, we select start from accounts where the username
is dollar username and the password is dollar password.
So basically whatever you input in the.
Text boxes for the username and the password is being directly used in here.
Now there was client side filtration and we were able to bypass that using the proxy.
So whatever we input in the proxy was being substituted in here.
So we could have we could modify the code by setting the username is equal to.
Or one is equal to one.
And then we added a comment.
So basically what happened in this statement right here instead of the username that was substituted?
So whatever the whatever we put in here was substituted and this value was injected.
So this was changed to a quotation and then.
Or one equals one comment.
And all of this was basically ignored.
Everything that comes after this was ignored which made our statement work.
So as you can see here, we closed the code that was already inserted and then we added all one is equal
to one, which is a true statement.
We put the username is admin.
Actually, that's what we did.
So.
This would be admin as well here.
So basically it's selecting anything where username is equal to admin and it doesn't care about the
password which was given us access to the admin account.
Now we could have injected also in the password saying or one is equal to one.
Again, it gives us a true statement and this was getting executed.
In this particular case here in the secure one.
What they're doing is they're doing a function which is called the real scape string.
And what this does, it basically removes characters such as the new line character, the break character
and the quotation.
So a single code or a double code.
So it scans it scans the input that we put right here and it removes any quotations that we put.
So if we put the single code right here or when we are put in the double code, it was removing it.
So when it removes it, it basically renders everything inside it as a string.
Another problem with this.
Now, I said this is only secure in this particular case because they're also adding a quotation right
here before and after the input.
So if there was no quotation, then our inject injection.
What we need to inject will not need to contain a quotation, and that way we'll be able to bypass this
function.
But because they're using, they're actually heart code in quotations in here, right here and right
there at the end, at the start and at the end of the input.
And then they're also escaping any quotation.
So if the input contains any quotations, they're removing it.
Then whatever we inject, whatever text you put in, there will be considered as, as a string.
So it will only be considered as normal text and it will never be considered as code.
Therefore it will never be executed on the server only in this case.
So let's just have examples.
So we have our admin here.
So this is the injection that we're always using.
So if we're going to put this.
So this is our username here.
So basically what's happening is this is coming up to the code and then the code is going to scan this
and it will notice that there is a quotation right here and because there is a quotation, it's going
to remove it.
This particular function will remove it.
So after the function is applied, the this will disappear and also the function will disappear.
So this is what's going to look like to the code, to the computer.
This is what's going to see.
And it will basically just see a normal string and which is contained within two quotes as well.
So we need to remove the dots here.
And notice that they already hardcoded these two quotes.
So because of that, our injection will never work.
Now, if they didn't include these codes, if they didn't hardcoded them here, if they didn't exist,
even though they use the function, this injection will work.
But because they use the quotes, whatever that's going to come when inside the quotes will be considered
as string.
And because they're checking that our input should not contain quotes on the server side, then whatever
we put will be stripped out from the quotes and it will never be considered as code.
Again.
This isn't the best way to secure your website.
I'll explain the best way at the last lecture of this section.
But this is a good way to temporarily secure your your website if you didn't have time to implement
the proper procedure.