mysql的query开发,通过mysql_query进行SQL注入

I'm working on a site that has been hacked through SQL Injection (at first glance only db entries are corrupted with cross-site scripting) the potential vulnerability I found after looking at the code is that there's a lot of mysql_query call whose inputs are not escaped at all.

The good old :

$query = "SELECT * FROM mytable where name LIKE '%".$_GET['name']."%'"; /*HACK HERE*/

mysql_query($query, $connection);

Nevertheless I can't find how can we do something cool from that injection vulnerability (by cool I mean something like an INSERT or an UPDATE). I've tried to build a statement like this one :

SELECT * FROM mytable where name LIKE '%' AND WHERE id IN (INSERT INTO secondtable (id,description) VALUES (15, 'Fifteenth description');--%'

No success. I guess that the INSERT has nothing to do here.

I'm escaping all user's inputs in the code right now but I've not really get how hackers have penetrated this site, then I'm not 100% sure that my fix will do the job. Any brilliant suggestions ?

Thanks

解决方案

Depending upon the version of mysql you are using, and the setup of the connection, mysql_query may allow more than one statement.

You should look at how the connection is being created, and for any usage of mysql_set_server_option.