SQL Injection(In PHP) Vulnerability Check..help
<I posted this but wonder where it goes :|, so i will post again>
I asked this question in j!nx but their members are too rude, so i have too seek help here :D Yes, i'm learning sql injection but i have no intention to hack those big company…just HYIP…if you know
I have read alot on sql injections on the net regrding asp but what i want to know is php, hope you ppl can help me answer my questions:
-
From the net, it seems that sql injections is done be manipulating the URL or just putting some query in the field (e.g login form). But i heard that there is "MYSQL injections script", is it possible to make one?
-
How to know if a site is vulnerable to sql injections? Take this HYIP site as example: http://www.egoldace.com (This is a future HYIP scam, and BTW i did not ask to hack, jst chack :))
Here is my sample HYIP site, try sql injecting and tell me if it is possible: http://kohkoh.freefronthost.com
Those truely clear me up abit :) So if for instance i put a ' in the username and anything in the password, if it don't give any error, the site is pretty safe and are called "Blind SQL injections".
So what can we do to update DB datas? Below is the table(ot to be specific 'egold_account' and 'deposit_total' i want to update):
CREATE TABLE
hm2_users(idbigint(20) NOT NULL auto_increment,namevarchar(200) default NULL,usernamevarchar(20) default NULL,passwordvarchar(50) default NULL,date_registerdatetime default NULL,egold_accountbigint(20) NOT NULL default '0',statusenum('on','off','suspended') default NULL,came_fromtext NOT NULL,refbigint(20) NOT NULL default '0',deposit_totalfloat(10,2) NOT NULL default '0.00',confirm_stringvarchar(200) NOT NULL default '',ip_regvarchar(15) NOT NULL default '',last_access_timedatetime NOT NULL default '0000-00-00 00:00:00',last_access_ipvarchar(15) NOT NULL default '',stat_passwordvarchar(200) NOT NULL default '',auto_withdrawint(11) NOT NULL default '1',user_auto_pay_earningint(11) NOT NULL default '0',admin_auto_pay_earningint(11) NOT NULL default '0',pswdvarchar(50) NOT NULL default '',evocash_accountbigint(20) NOT NULL default '0',intgold_accountbigint(20) NOT NULL default '0',hidvarchar(50) NOT NULL default '',l_e_tdatetime NOT NULL default '2004-01-01 00:00:00',activation_codevarchar(50) NOT NULL default '',bf_countertinyint(3) unsigned NOT NULL default '0',addressvarchar(255) default NULL,cityvarchar(255) default NULL,statevarchar(255) default NULL,zipvarchar(255) default NULL,countryvarchar(255) default NULL,transaction_codevarchar(255) default NULL,stormpay_accountvarchar(200) NOT NULL default '',ebullion_accountvarchar(200) NOT NULL default '',paypal_accountvarchar(200) NOT NULL default '',goldmoney_accountvarchar(200) NOT NULL default '',eeecurrency_accountbigint(20) NOT NULL default '0',pecunix_accountbigint(20) NOT NULL default '0',actext NOT NULL, PRIMARY KEY (id) ) AUTO_INCREMENT=3 ;