> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/error-based.md).

# Error Based

Error-Based SQL Injection is a type of SQL injection vulnerability where an application returns database error messages to the user. These errors can reveal valuable information about the backend database, such as the database type, version, query structure, table names, and column names.

The vulnerability occurs when user-controlled input is directly included in a SQL query, and the application exposes database errors instead of handling them securely.

***

### Vulnerable PHP Code Example

```php
<?php

$conn = mysqli_connect("localhost", "root", "password", "shop");

$id = $_GET['id'];

$query = "SELECT * FROM products WHERE id = '$id'";

$result = mysqli_query($conn, $query);

if (!$result) {
    die("Database Error: " . mysqli_error($conn));
}

while ($row = mysqli_fetch_assoc($result)) {
    echo $row['name'];
}

?>
```

***

### Code Explanation

The application retrieves the value of the `id` parameter from the URL:

```php
$id = $_GET['id'];
```

It then directly inserts that value into the SQL query:

```php
$query = "SELECT * FROM products WHERE id = '$id'";
```

For a normal request:

```
product.php?id=5
```

The resulting query becomes:

```sql
SELECT * FROM products WHERE id = '5'
```

If the query fails for any reason, the application displays the database error:

```php
die("Database Error: " . mysqli_error($conn));
```

Exposing raw database errors allows an attacker to gather information about the application's backend database.

***

### How the Vulnerability Works

1. **Identify a database-backed parameter** – The attacker looks for parameters that appear to retrieve information from a database, such as `product.php?id=5` or `page.php?id=16`. If changing the value changes the displayed content, the parameter is likely used in a SQL query.
2. **Attempt to break the query** – The attacker supplies unexpected input and observes the application's response. If a database error is returned, it indicates that user input is reaching the SQL query and is not being handled safely.
3. **Understand the query structure** – After confirming that input affects the query, the attacker attempts to understand how the SQL statement is constructed. The objective is to learn how data is being retrieved and how the application's query behaves.
4. **Identify visible output locations** – The attacker observes which parts of the database response are reflected in the application's output. This helps determine where information may become visible on the page.
5. **Gather database information** – Error messages may reveal details such as the database type, version, current database, or database user. These details help the attacker understand the backend environment.
6. **Enumerate database objects** – Using the information gathered, the attacker maps the database structure by identifying available databases, tables, and columns.
7. **Locate sensitive data** – After understanding the database structure, the attacker searches for tables that may contain valuable information such as user accounts, administrative records, customer information, or application data.
8. **Extract information** – If the vulnerability remains exploitable, the attacker may be able to access data stored in the database. The extent of exposure depends on the application's design and the permissions assigned to the database account.