[maddinat0r]

Quote:

Originally Posted by Reynolds I am trying to perform an SQL injection using this plugin on my own server (solely for pentest purposes) and I have a question. I have a command whose input is deliberately unescaped and I am trying to delete a table abusing this mistake. The code is: Код: CMD:testtest( playerid, params[] ) { TestT( "asd", params ); return 1; } TestT(nme[], tst[]) { format(query, sizeof(query), "INSERT INTO `test` (`asdfg`, `fghij`) VALUES ('%s', '%s')", nme, tst); mysql_query(query); return 1; } Using deliberately malicious input such as: Код: /testtest fgh'); DROP TABLE `example`;-- yields the following error: Код: [23:44:38] CMySQLHandler::Query(INSERT INTO `test` (`asdfg`, `fghij`) VALUES ('asd', 'fgh'); DROP TABLE `example`;-- ')) - An error has occured. (Error ID: 1064, You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE malibusux;-- ')' at line 1) The following code runs perfectly fine on phpMyAdmin. Is there a reason why these attacks do not work, or am I doing something wrong?

You did nothing wrong. I intentionally disallowed the execution of multiple SQL statements in one query.
However, that doesn't mean, that you are now completely safe against SQL injections. There are still ways to cause damage without using multiple SQL statements.