---
title: "Understanding the SQL injection used in the demo lesson - Cybr"
description: "Understanding the SQL injection used in the demo lesson: a thread from the Introduction to Application Security (AppSec) forum on Cybr, with 2 replies. Read-only archive."
url: https://cybr.com/forums/topic/understanding-the-sql-injection-used-in-the-demo-lesson/
---

Topic

# Understanding the SQL injection used in the demo lesson

2 replies

**Archived.** These forums are read-only. The conversation continues on [Discord](https://cybr.com/discord/).

1. Christophe

   Jun 15, 2020

   In [this lesson](https://cybr.com/courses/introduction-to-application-security-appsec/lessons/sql-injection-attacks-part-3/), we performed a SQL injection against the Damn Vulnerable Web Application in order to extract usernames and passwords from the database.

   This is the injection we used:

   ```
   %' and 1=0 union select null, concat(user,';',password) from users #
   ```

   Here's an explanation of how it works:

   - We might expect the query to look something like this:

   ```
   SELECT * FROM users WHERE id ='%' and 1=0
   union
   SELECT null, concat(user,';',password) from users #
   ```

   - % Represents zero or more characters, so it can be useful for pattern matching. ie: if we had cy%, it could match cybr; cyclone; etc
   - The UNION operator is used to combine the result set of two or more SELECT statements
   - SELECT null is used because UNION requires the same columns, data types, and number of columns to be pulled so that it can match it all up. But since we may not know what those exact columns are in the 1st select statement (since the app constructed it, not us), we use null.
   - We then use the concat() command to separate the username and passwords from one another in the return statement, like this: user;password
   - Since we can cheat, though, by [looking at the source code](https://raw.githubusercontent.com/ethicalhack3r/DVWA/master/vulnerabilities/sqli/source/low.php), we can see what the exact query looks like:

   ```
   SELECT first_name, last_name FROM users WHERE user_id = '$id';
   ```

   We can also see what is being outputted:

   ```
   $html .= "ID: {$id} First name: {$first} Surname: {$last}";
   ```

   So the reason we are seeing our injection returned in the ID output is because the application is simply spitting out the $id variable it grabbed from our input in the form.

   The reason we see the extracted data in the Surname and not the First name is because the SELECT null matches up with SELECT first\_name, and the SELECT concat() matches up with SELECT last\_name.

   One more challenge for you...not all options added in that SQL injection are needed for a successful extraction, at least not in the 'low' security setting of the DVWA. Try to see what causes this injection to stop working, and try to figure out why!

2. issam

   Sep 20, 2020

   great explanation thank you

   Christophe

   Sep 20, 2020

   Glad it helps!

[< Back to Introduction to Application Security (AppSec)](https://cybr.com/forums/forum/introduction-to-application-security/)