CSE3IIS - Assignment 2

Student: Rory Perry Student No.: 17411167

This page provides access to SAFE or Sanitised inputs and UNSAFE or Unsanitised inputs. Where appropriate you will be advised of what queries can be executed to inject the database.


Database Functions

Here you will find the button for re-creating the database. This is not a necessary component given that newer versions of PHP have prevented the insertion of secondary queries such as DROP TABLE, UPDATE, DELETE FROM or INSERT INTO which could otherwise cause significant harm to the database.

Input Tests

The way this page is designed enables you to choose between Safe (Sanitised) or Unsafe (Unsanitised) inputs for the below form. Thanks to the more modern design of PHP you are not able to actually inject through the use of an INSERT INTO, DELETE FROM, DROP TABLE OR UPDATE command. The only possible injection that I discovered through trial and error was the use of a UNION to execute a secondary SELECT query. This however only works under a very strict guideline. The union must be selecting the same amount of columns in the second query as the original query and must be selecting from the same table. These issues exist only on the PHP page itself and are not replicable in PHPMyAdmin where the queries execute successfully as per the provided examples further below.