What’s the risk with this intel?

Question

Speak people, what risk would I take if someone wanted to give an insight into this example:

$valorGet = $_GET["valor"];
$sql = "SELECT * FROM tabela WHERE caminho = '$valorGet'";

My question is, can the guy delete (DELETE) or insert (INSERT) something into my database? Or just give another type of SELECT?

There is a need to do an antijection with PDO in this case to increase safety?

Answer 1

Yes, there is a risk of someone deleting your entire bank when exploiting this vulnerability. The solution does not necessarily go through PDO, but through Prepared statements, that you can use with both PDO and mysqli. Note that it is not enough to change the connection driver to the database to solve the problem, you need to parameterize the query as explained in How to prevent SQL code injection into my PHP code.

Answer 2

To N ways to insert data, delete, join tables, etc. In a simple query like this... Here’s a classic and basic example to ignore the path:

$valorGet = "';DELETE FROM tabela WHERE 1=1;-- ";

$sql = "SELECT * FROM tabela WHERE caminho = '$valorGet'";

in this case the structure would receive:

 $sql = "SELECT * FROM tabela WHERE caminho = 'aqui entra o valor injetado: (';INSERT INTO tabela VALUES ('1','2','3','4');-- )'";

Whose way out would be something like this:

$sql = "SELECT * FROM tabela WHERE caminho = '';DELETE FROM tabela WHERE 1=1;--";