SQL injection in Node Mysql library

Question

I was trying to do some sql injection in node mysql library.

I have an Insert query written in Nodejs using by doing:

  pool.query(`Insert into orders(orderType,CustomerID,storeNumber,stageNumber) Values('${orderType}',${customerID},'${storeNumber}','${stageNumber}')`,function(err,rows,fields){
     if(err){
            console.log(err)
        }
        var orderID=rows.insertId
    }

All of the varaibles comes form a form which I am receiving using req.body

In the stageNumber field in the form instead of the storeNumber I was writing:

'); Delete from orderDetail;

This did not delete anything from my table

From my console.log(err) i get

Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Delete from orderDetail;')'

I cannot think of a way to remove the ')' but I know where it is coming from. Is it even possible to do SQL injection in Node MySQL library?

It won't allow you to execute multiple queries in a single call. You can do SQL injection, but not the kind that creates multiple queries. — Barmar
– Barmar, Commented Jul 31, 2019 at 5:15
Most MySQL APIs don't allow multiple queries, so Little Bobby Tables can't succeed. — Barmar
– Barmar, Commented Jul 31, 2019 at 5:16
The only API I know of that allows multiple queries is mysqli_multi_query() in PHP. — Barmar
– Barmar, Commented Jul 31, 2019 at 5:16

Shirish Goyal · Accepted Answer · 2019-07-31 05:18:31Z

1

Have you already tried

'); Delete from orderDetail; --

This will ignore any characters post -- and should ideally work in this case.

answered Jul 31, 2019 at 5:18

Shirish Goyal

5002 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

SQL injection in Node Mysql library

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related