how does mysql interpret escaped string?

Question

<?php
$user = 'john';
$pwd = "' OR ''='";
$sql = "SELECT * FROM users WHERE
user='" . $user . "' AND password='" . $pwd . "'";
echo $sql.'<br />';
// escape username and password for use in SQL
$user = mysql_real_escape_string($user);
$pwd = mysql_real_escape_string($pwd);

$sql_escaped = "SELECT * FROM users WHERE
user='" . $user . "' AND password='" . $pwd . "'";

echo $sql_escaped;
?>

It shows:

SELECT * FROM users WHERE user='john' AND password='' OR ''=''
SELECT * FROM users WHERE user='john' AND password='\' OR \'\'=\''

Question:

How does mysql interpret this line: password='\' OR \'\'=\''? password equals \ or what?

Escape sequences in MySQL are almost identical to escape sequences in PHP. Even Stack Overflow's syntax highlighter gives a pretty good clue... — Álvaro González
– Álvaro González, Commented Jul 29, 2013 at 9:42

MrCode · Accepted Answer · 2013-07-29 09:42:55Z

1

It will find records where the password matches exactly ' OR ''='

The backslash is escaping the single quotes so that the $pwd can't break out of the outer containing quotes.

Escaping in this way is a primitive way of preventing SQL Injection. Prepared Statements are much preferred because no escaping is required, the MySQL engine receives the variables as parameters separately to the query and so no concatenation is required and leaves no possibility of SQL Injection.

answered Jul 29, 2013 at 9:42

MrCode

64.6k10 gold badges95 silver badges114 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

ferdynator · Accepted Answer · 2013-07-29 09:40:48Z

0

"password equals \ or what?"

No, because a \ always escapes the following character. So in your case password would equal ' OR ''='. The \ make sure that the following character is not interpreted as a single quote but as a string. That's what the method mysql_real_escape_string() is for. You can even see that in the SO-highlighting in your example.

More on the topic SQL Injection and some examples can be found here.

answered Jul 29, 2013 at 9:40

ferdynator

6,4083 gold badges30 silver badges57 bronze badges

Comments

jaczes · Accepted Answer · 2013-07-29 09:41:06Z

0

MYSQL do sth like this :

SELECT '\'1' - returns '1 because \ turns off special meaning of ' character

so in Your example your password='\' OR \'\'=\'' is interprated as ' OR ''='

answered Jul 29, 2013 at 9:41

jaczes

1,4042 gold badges9 silver badges16 bronze badges

Collectives™ on Stack Overflow

how does mysql interpret escaped string?

3 Answers 3

Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Related