Delicious injections

http://ishygddt.org/ is some shitty babby's first PHP + MySQL minisite, with more holes than a... I'm bad with metaphors.

* any value after / is passed directly to mysql_query without any quotes or escaping
* the query looks like "SELECT * FROM tsia_ishygddt.msgs WHERE id = $input"
* mysql_error() spits out HTML, so HTML injection works
* strip_tags is used on user output
* addslashes is used on query input, but of course this is completely useless as no single quotes were used around input in the query
* runs on a typical ubuntu/mysql/php setup

e.g. http://ishygddt.org/1 OR 1=1

U MENA http://ishygddt.org/1%20OR%201=1

Who are you quoting?

Hey guy from other thread.

maybe because the code monkey didn't use mysql_real_escape_string_real_this_time()

+_)(*&^#$@$*&()"LKJGH*(P><VCZXC<>http://www.cpcds/cpmUY)*#$FGH<MXCV
36yth"<script>"TRRHJYTK)(^%$#

+_)(*&^#$@$*&()"LKJGH*(P><VCZXC<>http://www.cpcds/cpmUY)*#$FGH<MXCV
36yth"<script>"TRRHJYTKhttp://dis.4chan.org/derefer?id='354
68596805
)(^%$#

+_)(*&^#$@$*&()"LKJGH*(P><VCZXC<>http://www.cpcds/cpmUY)*#$FGH<MXCV
36yth"<script>"TRRHJYTKhttp://dis.4chan.org/derefer?id='354
68596805<iframe>http://dis.4chan.org/derefer.php?url=%44%45</frame>;;
)(^%$#

INJECT MY ANUS