Here is a minimum working example of the issue I have. I know by now the error seems to be particular of my server/setup, but I'm still curious about what is going on. There are two files, m1.php and m2.php:
<form action="m2.php" method="post"> <br> <input type="text" name="j" /> <input type="submit" VALUE="Ok" /> </form>
<?php print_r($_POST); ?>
Everything works as expected (when you click ok, it prints the array with the value from the input box) with this exception: if the string I type is
VALUE';WAITFOR DELAY '00:00:24';--
the form is not processed. Deleting just one character from the above string works with no issues.
Checking the server logs, when the above string is the input no POST request appears on the log, while it does with any other string I can think of. The problem seems to be server-side, as Fiddler shows the POST request with content
and I could reproduce it in different browsers from different platforms. Is this an Apache issue? Maybe php? How could I tell?
I found this while running a security audit on the web site. There is no SQL server running, but the audit reports the issue. And I'm curious why that particular string triggers such behaviour.
Edit: in case anyone is interested, I just noticed that the behaviour described above does not depend on the php code at all. In fact, if I send via Fiddler a POST request to a non-existing page on my server, as long as the post content includes some field with the aforementioned string, the request goes unanswered. So it seems this is an Apache issue.