Why does a single-quote cause an error in my application? - php

Question

I got the vulnerable code below from a book about SQL injection. But when I try to exploit it and add ' to the input, it gives me an error like this:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
Why do I get this error?
// build dynamic SQL statement
$SQL = “SELECT ∗ FROM table WHERE field = ‘$_GET[“input”]’;”;
// execute sql statement
$result = mysql_query($SQL);
// check to see how many rows were returned from the database
$rowcount = mysql_num_rows($result);
// iterate through the record set returned
$row = 1;
while ($db_field = mysql_fetch_assoc($result))
{
if ($row <= $rowcount)
{
print $db_field[$row]. “<BR>”;
$row++;
}
}

Answer 1

I don't know whats up with your quotation characters, but lets look at this line of code instead:
$SQL = "SELECT ∗ FROM table WHERE field = '$_GET[input]';";
So lets say you want to exploit this and get all rows. If you set $_GET[input] = "' OR 1=1" you get the following SQL:
SELECT ∗ FROM table WHERE field = '' OR 1=1';"
This is invalid SQL. Why? Because at the end you have a stray ' that the SQL interpreter doesn't understand. After a condition there is not suppose to be a beginning of a quote, and all quotes should be closed! That is why you get an error.
So to do succesful injection you need to make sure you produce valid SQL. In this case you could try using the payload ' OR '' = ', that generates this:
SELECT ∗ FROM table WHERE field = '' OR '' = '';"
Or just use a comment, as in ' OR 1=1 --, to neutralize the rest of the query:
SELECT ∗ FROM table WHERE field = '' OR 1=1 --';"