note 95009 added to function.mysql-real-escape-string

There's an interesting quirk in the example #2 about SQL injection: AND takes priority over OR, so the injected query actually executes as WHERE (user='aidan' AND password='') OR ''='', so instead of returning a database record corresponding to an arbitrary username (in this case 'aidan'), it would actually return ALL database records. In no particular order. So an attacker might be able to log in as any account, but not necessarily with any control over which account it is. Of course a potential attacker could simply modify their parameters to target specific users of interest: <?php // E.g. attacker's values $_POST['username'] = ''; $_POST['password'] = "' OR user = 'administrator' AND '' = '"; // Malformed query $query = "SELECT * FROM users WHERE user='$_POST[username]' AND password='$_POST[password]'"; echo $query; // The query sent to MySQL would read: // SELECT * FROM users WHERE user='' AND password='' OR user='administrator' AND ''=''; // which would allow anyone to gain access to the account named 'administrator' ?> ---- Server IP: 208.69.120.55 Probable Submitter: 67.237.238.105 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/95009 Del: integrated -- https://master.php.net/note/delete/95009/integrated Del: useless -- https://master.php.net/note/delete/95009/useless Del: bad code -- https://master.php.net/note/delete/95009/bad+code Del: spam -- https://master.php.net/note/delete/95009/spam Del: non-english -- https://master.php.net/note/delete/95009/non-english Del: in docs -- https://master.php.net/note/delete/95009/in+docs Del: other reasons-- https://master.php.net/note/delete/95009 Reject -- https://master.php.net/note/reject/95009 Search -- https://master.php.net/manage/user-notes.php