php - SQL injection - update two tables at once in a non-stacked mysql_query -


i'm learning advanced sql injection techniques, find harder.

i've got php code this(i can't change this, it's php + mysql 5.6.19[innodb]):

$newvalue = $_post['newvalue']; if ($newvalue > 1000)     mysql_query("update `table` set `column1`='".$newvalue."' `id`='".$id."'"); 

i've worked out way fool php little bit passing valid number @ beginning in post parameter, this(this 1 changes other column value, that's nice, works):

1001', `column2` = 'some_value' `id` = 'some_other_value';# 

now i'd change(update) other table in same update query. remember! can't change code , mysql_query doesn't allow stacked queries(you can't perform multiple queries separating them semicolon).

in theory, might this(of course, doesn't work):

1001' `id` = 'some_other_value' or (update `table2` set ... = ... limit 1);# 

or(some theoretical trick):

1001'*(update `table2` set ... = ... limit 1) `id` = 'some_other_value';# 

do have ideas?
thank help.


Comments

Popular posts from this blog

asp.net mvc - SSO between MVCForum and Umbraco7 -

Python Tkinter keyboard using bind -

ubuntu - Selenium Node Not Connecting to Hub, Not Opening Port -