SQL Injection

[tsilenzio]

Using php how would i inject a whole .sql file filled with [CREATE tablename( data values and such) and INSERT INTO tablename] into a database using php code? :s

[The Little Guy]

you could do it through PHP myAdmin

[tsilenzio]

yea i know but i dont want the ppl using my script to have to do it i mean liek what if they dont got phpMyAdmin? thanx though

[The Little Guy]

I guess, in the php you would do this:

<textarea name="myField"></textarea>

<?php
if(mysql_query($_GET['myField'])){
echo 'Query was successful';
}else{
echo 'invalid query';
}
?>

[tsilenzio]

Yea but the only problem is that its 2 files not a textarea =/

[soycharliente]

<textarea><?php include "yoursqlfile.php"; ?></textarea>

[per1os]

www.php.net/file_get_contents ???

[tsilenzio]

Like i was thinking:

 

<?php

//code above

function injectSQL($filename)
    global $root_path;
    
    $handle = fopen($root_path . 'install/data/' . $filename, "r");
    $query = "";
    $lines = explode("\n", fread($handle, 1024768));
    fclose($handle);
    foreach($lines as $line)
    {
        if(!(strpos($line,"//") == 0) && $line != "") //check for commented lines or blanks
        {
            $query .= $line;
            if(!(strpos($line,";") == false))
            {
                if($filename = "sql_data.sql")
                {
                    $query = str_replace(array('admin_username', 'admin_password', 'admin_email', 'admin_race', '00000000000000'), array($username, $password, $email, $race, time()), $query);
                }
                processQuery($query); //Function that loads the config.php file, connects to DB and processes query
                $query = "";
            }
        }
    }
}

//more code

//
// Create all needed tables
//
injectSQL("sql_tables.sql");

//
// Load values into new tables
//
injectSQL("sql_data.sql");

?>

[tsilenzio]

forgot to ask is it possible to do mutiple "CREATE TABLE.." commands in a single query? or does it all have to be seperate for each CREATE? :s

[tsilenzio]

yes? maybe? no lol =/

[The Little Guy]

eval()

 

maybe your looking to do something with this???

[per1os]

forgot to ask is it possible to do mutiple "CREATE TABLE.." commands in a single query? or does it all have to be seperate for each CREATE? :s

 

Try it and find out, as long as the syntax is right and it has ; after each statement it should be fine.

[tsilenzio]

Thannx alot still sint 100% working but ill figure out whats wrong xD

[keeB]

..

 

You can't have multiple queries in a single mysql call..

 

What you would need to do is get the file, explode on ";", and then do a foreach calling mysql_query() on each array element.

[tsilenzio]

hey thats a good idea isntead of a newline lol then ill just remove any comments.. but wait how will i tell where a comment begins and end? >.> lol im not too good with string functions