In this lecture, we're going to go and have a look on the high security level and we'll see why it's
an injectable.
So let's go ahead first and set the security level to high.
Now I'm going to go back to my SQL injection.
And let's make sure that the page works first.
So I'm just going to put number one like we always did.
And as you can see now, the page works.
Now let's try to inject it after the one after the ID parameter like we always did.
And I'm going to put and one is equal to one.
So I'm putting a true statement.
And as you can see now, the page doesn't really work.
So let's try to put a single quote here to close it like we did with the low level.
And again, this injection doesn't work either.
Even though we're given a true statement that shouldn't interfere with the current request.
We usually don't look at the code when we're trying to hack, but as I said, this is an injectable.
So let's have a look on the code and we're going to compare it with the code used for the medium security
level and we'll see what's the difference is between the two codes so that we can learn how to secure
our websites.
So I'm going to search and change the security level to medium here just so that we can compare the
two codes.
And I'm going to go back to the SQL injection.
And I'm going to view the source as well.
And God put them beside each other.
So in here, in the medium security level, you can see that the ID is being read in here and it's been
stored in the ID variable, and then they're using a function called my SQL Real Escape.
So what this function does, it will go through every character in the ID variable, and it will look
for special characters such as single quotes and double codes and remove them.
Therefore, any quotation marks used or injected in the ID variable will actually be removed at this
line because of the use of the MySQL real escape string.
Now the thing is, once we go down to the SQL statement, you'll see that we actually don't need to
use any quotes to inject code into this statement.
So our statement is select first name, last name from users where a user ID is equal to ID.
So we actually don't need to close any quotes.
We don't need to inject quotes in the ID variable.
All we have to do is just put any ID like we did in the last video so we can put just number one and
then inject code straight away after the number one.
So when we use this code right here, we're basically we we didn't use the quotes in the medium, so
we are literally just giving the ID as number one.
And then we're saying union select column name, whatever from information schema tables.
So the code is just being injected straight away after the ID.
And then the database will read it and execute it.
No need to use quotes again because the code doesn't use any single code, so the code just says user
ID is equal to ID.
Now comparing this with the code that we have for the high security level, you'll see that it uses
the same function to skip special characters, but it's implemented in the right way, and that's by
using single quotes in the SQL statement around the ID.
Therefore, because the code is keeping the quotes that we put and because they're using quotes in there,
any code that we try to inject in here will actually be considered as if it's part of the ID.
So when we use this code right here, so if we just use the code as it is without a quote, then obviously
it will just be inserted instead of the ID variable between the two single quotes.
So it will just be considered as the ID.
Whereas if we inject that code in here, it will actually be executed as part of the SQL statement.
So let's have a look on what the SQL statement will look like when we inject our code in both in the
medium and in the high security level.
So I'm just going to bring down the text here.
So we have the SQL statement for the medium here.
And the SQL statement for the high security level.
And we'll just try to inject and one is equal to one, because as we've seen, if you can inject that,
then you can inject anything you want, really, and get it executed on the database.
So looking at the medium statement.
We're going to copy this code.
Now, this code will actually go and pass through the my SQL Real Escape character.
So it will be removed from any single code that it has, but it has nothing.
And the code will look like one, and one is equal to one.
So this statement is valid and and once equal to one will be injected.
Now, looking at the high security level, notice this use of the single quotes, which will mean that
the user ID is equal to one and one is equal to one.
So and one is equal to one will not be considered as part of the SQL statement, but it will be considered
as part of the user ID.
Now let's try to add a single quote and see what effect would that have on the SQL statements.
I'm actually going to get rid of this statement because we managed to inject it and we're only going
to focus on the high in the statement used in the high security level.
So we're using a single quote here to close it, and we're going to copy this.
Now, this will actually pass through the MySQL real escape string.
So the single quote that we're using here will actually be removed and this line will become.
One and one is equal to one.
So it's going to be equal or exactly the same as the line we used before.
Now, once this is substituted in here again, the one and one is equal to one will be considered as
part of the Z of the user ID and it won't be considered as part of the SQL statement.
From this, we can see that the use of the MySQL real escape string is not enough.
It has to be used with the single quotes right here and combined with that function, then this specific
SQL statement becomes an injectable.
Now in future lectures, we're actually going to discuss a better way to build web applications so that
they can't be injected with SQL statements.
But if you needed a quick solution, then you can go for this until you have time.
Then you can change the implementation of your website so that it can be injected.