Can you spot the SQL injection?

code-injection, mysql, sql

Solution

If `username` was something like `'' OR ''=''#` and `password` was `'anything'` it would short circuit the query to become:

SELECT *
FROM users
WHERE username ='' OR ''=''#AND password ='anything'

You can short circuit the logic by injecting SQL into parameters.

Problem

I was reading in 2600, but this article is also here https://viaforensics.com/mobile-security/static-code-analysis-watchtower.html Anyways there is a code block: ``` $result = mysql_query("SELECT * FROM users WHERE username = '{$_GET['username']}' AND `password` = SHA1('{$_GET['password']}')") ``` The author says "Readers of 2600 will spot the obvious SQL injections, but it seems that many programmers – remarkably – will not." Can someone explain and point out what he means? To me my guess was he meant that since it appears there's no cleaning of data for characters notorious for injection that it's vulnerable? I'm relatively novice to PHP5/MySQL and went over this code over and over looking for what's wrong but couldn't come to any other conclusion.

Original source