Search Parameter SQL Injection
Parameter ?q= dimasukkan langsung ke dalam klausul LIKE '%$q%' tanpa wildcard escaping atau escape string handling.
Product Search Input
Executed Raw Backend Query
SELECT * FROM products WHERE name LIKE '%test%' OR description LIKE '%test%'
SQLMap Command Example for Search Lab
Gunakan sqlmap untuk memindai parameter pencarian ini:
sqlmap -u "http://localhost/sqlmap-lab/search.php?q=test" -p q --tables
Search Results
No products match your search query.