Skip to content

SQLiChecker can't obtain whole query when there are multiple lines #50

@TaiYou-TW

Description

@TaiYou-TW

PoC:

WordPress database error <div style="clear:both">&nbsp;</div>
<div class="queries" style="clear:both;margin-bottom:2px;border:red dotted thin;">
<p>MySQL query:</p>
<p>SELECT * FROM `wp_aryo_activity_log`
                                 WHERE 1 = 1 AND `object_name` LIKE '%\'\";/\\-+=*\\`|)(#-- ,!@~<>%%'
                                        AND (`object_type` = 'Core' OR `object_type` = 'Export' OR `object_type` = 'Post' OR `object_type` = 'Taxonomy' OR `object_type` = 'User' OR `object_type` = 'Options' OR `object_type` = 'Attachment' OR>
                                        ORDER BY '$$'''''' DESC
                                        LIMIT 0, 20;</p>
<p>Queries made or created this session were:</p>
<ol>
<li>Executing: BEGIN | (no parameters)</li>
<li>Executing: ROLLBACK | (no parameters)</li>
</ol>
</div>
<div style="clear:both;margin-bottom:2px;border:red dotted thin;" class="error_message" style="border-bottom:dotted blue thin;">
Error occurred at line 4280 in Function <code>handle_error</code>. Error message was: Array
(
    [query] => SELECT * FROM `wp_aryo_activity_log`
                                 WHERE 1 = 1 AND `object_name` LIKE '%\'\";/\\-+=*\\`|)(#-- ,!@~<>%%'
                                        AND (`object_type` = 'Core' OR `object_type` = 'Export' OR `object_type` = 'Post' OR `object_type` = 'Taxonomy' OR `object_type` = 'User' OR `object_type` = 'Options' OR `object_type` = 'Attachment' OR>
                                        ORDER BY '$$'''''' DESC
                                        LIMIT 0, 20;
    [message] => Ending quote ' was expected.
    [str] =>
    [position] => 675
    [code] => 0
)
.
</div>
<p>Backtrace:</p>

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions