$id = $_COOKIE[ 'id' ];

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $query);

$exists = (mysqli_num_rows( $result ) > 0);

if ($exists) {
    $html .= '<pre>User ID exists in the database.</pre>';
} else {
    // Might sleep a random amount
    if( rand( 0, 5 ) == 3 ) {
        sleep( rand( 2, 4 ) );
    }
    
    header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
    $html .= '<pre>User ID is MISSING from the database.</pre>';
}
```bash

**Key Vulnerability**: 
- Still uses raw input with single quotes in the query
- Input comes from `$_COOKIE` instead of GET/POST
- Random sleeps on failures make time-based detection harder

#### Changes from Previous Levels

- Uses cookies instead of GET/POST parameters
- Adds random delays (2-4 seconds) to failed requests
- Keeps the LIMIT 1 clause
- Sets 404 header on failures

#### Why It's Vulnerable

The fundamental SQL injection vulnerability remains the same. Cookies are just another form of user input and can be manipulated just as easily as GET/POST parameters.

#### Testing Approach

You need to set the cookie value to inject SQL:

**Using Browser Developer Tools:**
```javascript
// Set cookie in browser console
document.cookie = "id=1' AND sleep(10)-- -";

curl -b "id=1' AND sleep(10)-- -" http://target/vulnerabilities/sqli_blind/
```text

**Time-Based Injection:**
- Use longer sleep times (10+ seconds) to account for random delays
- Random delays only happen on failures, not successes
- Success + sleep(10) = consistent 10+ second delay
- Failure = 0-4 second delay (random)

<Accordion title="Show Hint">
  The ID comes from a cookie value. You can set cookies using browser developer tools, proxy tools, or directly in HTTP requests.

  The random delays are only added to MISSING results. Successful queries with sleep commands will still show consistent delays.

  Use longer sleep times to distinguish your intentional delays from the random ones.
</Accordion>

<Accordion title="Show Spoiler">
  **Example payload**: Set cookie `id` to `1' AND sleep(10)-- -`

  The page will sleep for exactly 10 seconds if user 1 exists.

  Extract database version:

      You can also try to access the session setting page directly and bypass the cookie mechanism entirely.
    </Accordion>

  </Tab>

  <Tab title="Impossible">
    ### Secure Implementation

    The impossible level uses **parameterized queries** (prepared statements) to completely prevent SQL injection.

    #### Secure Code

    ```php
    $id = $_GET[ 'id' ];

    // Was a number entered?
    if(is_numeric( $id )) {
        $id = intval ($id);
        
        // Parameterized query
        $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
        $data->bindParam( ':id', $id, PDO::PARAM_INT );
        $data->execute();

        $exists = $data->rowCount();
    }

    if ($exists) {
        $html .= '<pre>User ID exists in the database.</pre>';
    } else {
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
        $html .= '<pre>User ID is MISSING from the database.</pre>';
    }