Username: 
Password: 
Restrict session to IP 

Double query  Go to the Training: MySQL II challenge

Global Rank: 130
Totalscore: 127323
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 8y 314d




Last Seen: 6d 19h
The User is Offline
Double query
Google/translate1Thank You!1Good Post!0Bad Post! link
I'm trying to inject a second command that will get executed after the select, but before the password check. Am I on the right track?
This works locally for me, but when I try it on wechall I get an "GDO 1064". Is there something "blocking" executing two queries with the command "queryFirst"?
Global Rank: 229
Totalscore: 84663
Posts: 1310
Thanks: 1158
UpVotes: 660
Registered: 10y 216d




Last Seen: 4h 27m
The User is Offline
RE: Double query
Google/translate0Thank You!1Good Post!0Bad Post! link
You cannot execute two queries in a single query.
This is a limitation, once introduced for security, in mysql/mysqli (if i recall correctly)

Most other languages and their mysql bindings should have the same limits.

I googled a bit and it seems that it would be possible.

Take a look at https://stackoverflow.com/questions/802437/how-to-execute-two-mysql-queries-as-one-in-php-mysql
The geeks shall inherit the properties and methods of object earth.
Global Rank: 8900
Totalscore: 73
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 99d 21h
Last Seen: 97d 17h
The User is Offline
RE: Double query
Google/translate1Thank You!1Good Post!0Bad Post! link
with the username, I can use the sql injection, but I don't know how to bypass the password check.
Global Rank: 1
Totalscore: 719334
Posts: 351
Thanks: 357
UpVotes: 296
Registered: 9y 54d











The User is Offline
RE: Double query
Google/translate1Thank You!1Good Post!0Bad Post! link
exp32, that is not a question. It also does not relate to the topic of this thread.

Perhaps research SQLi a bit more?
Global Rank: 229
Totalscore: 84663
Posts: 1310
Thanks: 1158
UpVotes: 660
Registered: 10y 216d




Last Seen: 4h 27m
The User is Offline
RE: Double query
Google/translate0Thank You!1Good Post!0Bad Post! link
@exp32: Just make your sent data fulfil the password check.... at least that's what i want you todo ;)
The geeks shall inherit the properties and methods of object earth.
tunelko, Redknee, silenttrack, qdxy, TheHiveMind, Z, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 994 times.