# Creating an SQL injection

**URL:** <https://forum.elixirforum.com/t/creating-an-sql-injection/27440>\
**Category:** Questions\
**Tags:** ecto, phoenix, sql\
**Created:** [December 8, 2019, 11:11pm UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440 "2019-12-08T23:11:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dstergiou](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/dstergiou/32/17609_2.png) [@dstergiou](https://forum.elixirforum.com/u/dstergiou)\
**Post date:** [December 8, 2019, 11:11pm UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440/1 "2019-12-08T23:11:17Z")

</div>

Hello,

first of all i apologize if this is a very basic question, but i only started playing with Elixir last week, and my knowledge of Elixir and Phoenix is minimal.

I am creating a webapp based on Elixir / Phoenix that is on purpose vulnerable to several web attacks. What i am trying to achieve now is a basic SQL Injection, but it seems that Phoenix is using parameterized queries which makes it impossible to have an SQL injection.

The code so far looks like this:

```elixir
content = Ecto.Adapters.SQL.query!(
          MyApp.Repo, "SELECT name,data from contents WHERE name=$1", [params["name"]]
       )

```

If i execute the code with a typical SQL injection string like `' OR '1' = ‘1`then Phoenix replies with:

> SELECT name,data from contents WHERE name=$1 [“’ OR ‘1’ = ‘1”]

If i execute the code with some valid name, then i see this:

> SELECT name,data from contents WHERE name=$1 [“Per”]  
> [[“Per”, “This is a test”]]

Which is what i would expect from this query.  
So, my question is, is there a way to write the `query` code to make this SQL injection viable?

In Python, it was as simple as:

```elixir
if request.method == 'POST':
        input = request.POST.get('input')
        query = "SELECT * from levels_content WHERE name = '%s'" % input
        result = Content.objects.raw(query)

```

Again apologies if this is a very basic question, and thanks in advance for the help

---

<div class="post-metadata">

**Author:** ![darkmarmot](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/darkmarmot/32/15926_2.png) [@darkmarmot](https://forum.elixirforum.com/u/darkmarmot)\
**Post date:** [December 8, 2019, 11:17pm UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440/2 "2019-12-08T23:17:51Z")

</div>

You probably want to drop down to a lower level library like `:postgrex` so that you can create injectable queries by hand?

---

<div class="post-metadata">

**Author:** ![dstergiou](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/dstergiou/32/17609_2.png) [@dstergiou](https://forum.elixirforum.com/u/dstergiou)\
**Post date:** [December 8, 2019, 11:44pm UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440/3 "2019-12-08T23:44:21Z")

</div>

Hey,

i checked here: [Postgrex — Postgrex v0.22.2](https://hexdocs.pm/postgrex/Postgrex.html#query/4) for `query/4` and it seems that passing attributes as parameters is mandatory - at least this is what i understand from this example:

`Postgrex.query(conn, "SELECT id FROM posts WHERE title like $1", ["%my%"])`

Ideally i would like to do some string interpolation, and end up with something like:  
`Postgrex.query(conn, "SELECT id FROM posts WHERE title like #{input}")`

`input` being what i received from the HTML form

---

<div class="post-metadata">

**Author:** ![hauleth](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/hauleth/32/18942_2.png) [@hauleth](https://forum.elixirforum.com/u/hauleth)\
**Post date:** [December 8, 2019, 11:54pm UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440/4 "2019-12-08T23:54:55Z")

</div>

You can do the same using Ecto itself:

```elixir
MyApp.Repo.query("SELECT id FROM posts WHERE title like #{input}", [])

```

---

<div class="post-metadata">

**Author:** ![dstergiou](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/dstergiou/32/17609_2.png) [@dstergiou](https://forum.elixirforum.com/u/dstergiou)\
**Post date:** [December 9, 2019, 12:25am UTC](https://forum.elixirforum.com/t/creating-an-sql-injection/27440/5 "2019-12-09T00:25:36Z")

</div>

Thanks, that did the trick, here is the final line:

```elixir
    name = params["name"]
    content = Ecto.Adapters.SQL.query!(
      ElixirTrustlyctf.Repo, "SELECT name,data from contents WHERE name=\'#{name}\'", []
    )

```

Cheers