4

What does it mean?

SELECT * from users where password = ''*'';

if I check this in mysql workbench I get only one line, although I have lot of users in table.

What exactly does this select?

3 Answers 3

6

Interesting question. Let's see what ''*'' does.

mysql> select ''*'';
+-------+
| ''*'' |
+-------+
|     0 |
+-------+

Let's create some users:

mysql> select * from users;
+------+-------+
| id   | name  |
+------+-------+
|    1 | joe   |
|    2 | moe   |
|    3 | shmoe |
|    4 | 4four |
+------+-------+

And test our query:

mysql> select * from users where name = ''*'';
+------+-------+
| id   | name  |
+------+-------+
|    1 | joe   |
|    2 | moe   |
|    3 | shmoe |
+------+-------+

Interestingly enough, user 4 was not selected! But let's try this way:

mysql> select * from users where name = 4;
+------+-------+
| id   | name  |
+------+-------+
|    4 | 4four |
+------+-------+

So, what can we deduct from this?

  1. ''*'' somehow means 0 (I am not that fluent in mysql string operators, so let's take it as a fact);
  2. MySQL, apparently, does type conversions in this case. So if you query a varchar column against an integer, it tries to convert those strings to ints and see if it's a match;
  3. You have only one row whose password begins with 0 or non-digit.
5
  • 1
    This quite familiar operator has nothing to do with string operations ;) Commented Mar 7, 2017 at 19:12
  • Look at it closely, it's really simple. You know this operator perfectly well :) Commented Mar 7, 2017 at 19:17
  • But indeed this case is wonderful, gonna add it my collection. Commented Mar 7, 2017 at 19:18
  • @YourCommonSense: you mean that this is number multiplication operator and mysql casts both sides to numbers? I'd expect an error here, if both operands are not numbers :) Commented Mar 7, 2017 at 19:20
  • 1
    MySQL can cast anything ) Commented Mar 7, 2017 at 19:23
5
  1. You can always use an expression in SQL. Like SELECT 5-4 AS one and get 1. So you can tell that here is an expression.
  2. MySQL is a loosely typed language, so it can multiply strings. Casting them to numbers. And get you zero as a result of '' * ''
  3. When comparing a string with a number, MySQL casts both to a number. So 0 = 'name' condition will get you true
4

The ''*'' is a multiplication: its two arguments (empty strings) are converted to numericals (i.e. 0) and the result is 0. Then the left side of the equation is also converted to a number, which will sometimes be zero (when the password cannot be evaluated to a non-zero number), sometimes not.

It is a bit obscure, and you could ask yourself whether this was intended in your case or an accidental behaviour, while the actual intention was to test for '*'. A user with bad intentions might have entered '*' as a password hoping you were not protected against SQL injection in order to get into the system without a valid password.

3
  • Testing for equality to '*' is a bit pointless for such attack, don't you agree? Unless you manage to sneak LIKE in as well. But maybe it was a next step. Commented Mar 7, 2017 at 19:22
  • The attack, if indeed this is what happened, would be just the entering of '*' as password. The rest of the SQL would have been in the (bad) program code already.
    – trincot
    Commented Mar 7, 2017 at 19:27
  • Yes, that's what I meant. Commented Mar 7, 2017 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.