Peculiar webshop search query

Question

In Magento's admin panel, I can see that a visitor of my magento website entered the following search query in the webshop's search bar:

productName" and (4=4 xor 6=9)-- a

where productName was originally the name of a product we sell.

I know what and and xor are for (though usually (in frontend usage) it only works when entered fully capitalized, I believe), but otherwise I don't understand what the visitor was trying to do here.

I am wondering if this is a hacking attempt. Is this a possibility? If yes, what was this person trying to achieve, and how can I prevent such attempts in the future?

Answer 1

I think someone is looking for SQL injection vulnerabilities.
he is looking to see if you sanitize your input variables.
Let's say that your search query would look like this:

'SELECT * FROM tbl WHERE name like "%'.$_GET['q'].'%"

This is wrong (and don't worry, magento does not do it this way).
Entering in search what he did productName" and (4=4 xor 6=9)-- a you endup with

'SELECT * FROM tbl WHERE name like "%productName" and (4=4 xor 6=9)-- a%"'

so and (4=4 xor 6=9) will be evaluated by the db engine and what's after -- will be considered comment.

The fact that you see this search text logged in the search tables means that magento does a good job in handling these potential sql injection attempts, so you are on the safe side.

You don't need to worry on one side, but you may want to look who is testing your website for vulnerabilities.