Added SQL injection protection for Mysqli and several test cases

17 files changed, 428 insertions, 40 deletions

diff --git a/Changelog b/Changelog
index 2bad2b3..4e83cb3 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,7 @@
+2014-06-24 - 0.9.37-dev
+
+        - Added SQL injection protection for Mysqli and several test cases
+
 2014-06-10 - 0.9.36
 
     - Added better handling of non existing/non executable shell scripts
diff --git a/execute.c b/execute.c
index 1f7cf15..098b074 100644
--- a/execute.c
+++ b/execute.c
@@ -880,7 +880,7 @@ int ih_querycheck(IH_HANDLER_PARAMS)
                 return (0);
         }
     
-        if ((long) ih->arg1) {
+        if ((long) ih->arg2) {
             mysql_extension = 1;
         }
         
@@ -892,6 +892,7 @@ int ih_querycheck(IH_HANDLER_PARAMS)
         }
         len = Z_STRLEN_P(backup);
         query = Z_STRVAL_P(backup);
+        SDEBUG("SQL |%s|", query);
         
         s = query;
         e = s+len;
@@ -1552,9 +1553,9 @@ static int ih_getrandmax(IH_HANDLER_PARAMS)
 }
 
 internal_function_handler ihandlers[] = {
-    { "preg_replace", ih_preg_replace, NULL, NULL, NULL },
-    { "mail", ih_mail, NULL, NULL, NULL },
-    { "symlink", ih_symlink, NULL, NULL, NULL },
+        { "preg_replace", ih_preg_replace, NULL, NULL, NULL },
+        { "mail", ih_mail, NULL, NULL, NULL },
+        { "symlink", ih_symlink, NULL, NULL, NULL },
         
         { "srand", ih_srand, NULL, NULL, NULL },
         { "mt_srand", ih_mt_srand, NULL, NULL, NULL },
@@ -1563,49 +1564,86 @@ internal_function_handler ihandlers[] = {
         { "getrandmax", ih_getrandmax, NULL, NULL, NULL },
         { "mt_getrandmax", ih_getrandmax, NULL, NULL, NULL },
         
-    { "ocilogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "ociplogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "ocinlogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_connect", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_pconnect", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_new_connect", ih_fixusername, (void *)1, NULL, NULL },
+        { "function_exists", ih_function_exists, NULL, NULL, NULL },
         
-    { "fbsql_change_user", ih_fixusername, (void *)1, NULL, NULL },
-    { "fbsql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "fbsql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    
-    { "function_exists", ih_function_exists, NULL, NULL, NULL },
+        /* Mysqli */
+        { "mysqli::mysqli", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli::real_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        { "mysqli_change_user", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli::change_user", ih_fixusername, (void *)1, NULL, NULL },
+        
+        { "mysqli::query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::multi_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_multi_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::prepare", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_prepare", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::real_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_real_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::send_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_send_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        // removed in PHP 5.3
+        { "mysqli_master_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli_slave_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        // ----
+        
+        /* Mysql API - deprecated in PHP 5.5 */
+        { "mysql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysql_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysql_db_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysql_unbuffered_query", ih_querycheck, (void *)1, (void *)1, NULL },
         
-    { "ifx_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "ifx_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* MaxDB */
+        { "maxdb::maxdb", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb::real_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        { "maxdb::change_user", ih_fixusername, (void *)1, NULL, NULL },
+        { "maxdb_change_user", ih_fixusername, (void *)2, NULL, NULL },
+        
+        { "maxdb_master_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::multi_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_multi_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::real_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_real_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::send_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_send_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::prepare", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_prepare", ih_querycheck, (void *)2, NULL, NULL },
 
-    { "ibase_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "ibase_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* Oracle OCI8 */
+        { "ocilogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "ociplogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "ocinlogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_connect", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_pconnect", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_new_connect", ih_fixusername, (void *)1, NULL, NULL },
 
-    { "maxdb", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_change_user", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        /* FrontBase */
+        { "fbsql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "fbsql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "fbsql_change_user", ih_fixusername, (void *)1, NULL, NULL },
+        { "fbsql_username", ih_fixusername, (void *)2, NULL, NULL },
 
-    { "mssql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mssql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* Informix */
+        { "ifx_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ifx_pconnect", ih_fixusername, (void *)2, NULL, NULL },
 
-    { "mysql_query", ih_querycheck, (void *)1, (void *)1, NULL },
-    { "mysql_db_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysql_unbuffered_query", ih_querycheck, (void *)1, (void *)1, NULL },
-    { "mysqli_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_real_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_send_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_master_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_slave_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        /* Firebird/InterBase */
+        { "ibase_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ibase_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ibase_service_attach", ih_fixusername, (void *)2, NULL, NULL },
 
-    { "mysqli", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysqli_change_user", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_real_connect", ih_fixusername, (void *)3, NULL, NULL },
-    { NULL, NULL, NULL, NULL, NULL }
+        /* Microsoft SQL Server */
+        { "mssql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mssql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        
+        { NULL, NULL, NULL, NULL, NULL }
 };
 
 #define FUNCTION_WARNING() zend_error(E_WARNING, "%s() has been disabled for security reasons", get_active_function_name(TSRMLS_C));
diff --git a/tests/sql/connect.inc b/tests/sql/connect.inc
new file mode 100644
index 0000000..367d63d
--- /dev/null
+++ b/tests/sql/connect.inc
@@ -0,0 +1,14 @@
+<?php
+
+        $host      = getenv("MYSQL_TEST_HOST")     ? getenv("MYSQL_TEST_HOST") : "localhost";
+        $port      = getenv("MYSQL_TEST_PORT")     ? getenv("MYSQL_TEST_PORT") : 3306;
+        $user      = getenv("MYSQL_TEST_USER")     ? getenv("MYSQL_TEST_USER") : "root";
+        $passwd    = getenv("MYSQL_TEST_PASSWD")   ? getenv("MYSQL_TEST_PASSWD") : "";
+        $db        = getenv("MYSQL_TEST_DB")       ? getenv("MYSQL_TEST_DB") : "test";
+        $socket    = getenv("MYSQL_TEST_SOCKET")   ? getenv("MYSQL_TEST_SOCKET") : null;
+
+        function connect_mysqli_oostyle() {
+                global $host, $port, $user, $passwd, $db, $socket;
+                return new mysqli($host, $user, $passwd, $db, $port, $socket);
+        }
+?>
\ No newline at end of file
diff --git a/tests/sql/mysqli_comment_conditional.phpt b/tests/sql/mysqli_comment_conditional.phpt
new file mode 100644
index 0000000..0436c64
--- /dev/null
+++ b/tests/sql/mysqli_comment_conditional.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL comment protection and MySQL condition (/*!...*/)
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=2
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 /*! ... */");
+flush();
+echo "mark.";
+?>
+--EXPECTF--
+mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_comment_cstyle_fail.phpt b/tests/sql/mysqli_comment_cstyle_fail.phpt
new file mode 100644
index 0000000..56a8ccb
--- /dev/null
+++ b/tests/sql/mysqli_comment_cstyle_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL comment (/*...*/) protection set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=2
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 /* injection */");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Comment in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/mysqli_comment_hashstyle_fail.phpt b/tests/sql/mysqli_comment_hashstyle_fail.phpt
new file mode 100644
index 0000000..6f5b517
--- /dev/null
+++ b/tests/sql/mysqli_comment_hashstyle_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL comment (#) protection set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=2
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 # injection");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Comment in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/mysqli_comment_sqlstyle.phpt b/tests/sql/mysqli_comment_sqlstyle.phpt
new file mode 100644
index 0000000..c32c76a
--- /dev/null
+++ b/tests/sql/mysqli_comment_sqlstyle.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL comment (--) protection
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=1
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 -- injection");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Comment in SQL query.*mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_comment_sqlstyle_fail.phpt b/tests/sql/mysqli_comment_sqlstyle_fail.phpt
new file mode 100644
index 0000000..83e63c5
--- /dev/null
+++ b/tests/sql/mysqli_comment_sqlstyle_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL comment (--) protection set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=2
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 -- injection");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Comment in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/mysqli_multiselect.phpt b/tests/sql/mysqli_multiselect.phpt
new file mode 100644
index 0000000..63d6c19
--- /dev/null
+++ b/tests/sql/mysqli_multiselect.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with multiple SELECT statements
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=1
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1; SELECT 2");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Multiple SELECT in SQL query.*mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_multiselect_fail.phpt b/tests/sql/mysqli_multiselect_fail.phpt
new file mode 100644
index 0000000..2bee62a
--- /dev/null
+++ b/tests/sql/mysqli_multiselect_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with multiple SELECT statements set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=2
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1; SELECT 2");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Multiple SELECT in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/mysqli_multiselect_subselect.phpt b/tests/sql/mysqli_multiselect_subselect.phpt
new file mode 100644
index 0000000..e629720
--- /dev/null
+++ b/tests/sql/mysqli_multiselect_subselect.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with sub-SELECT
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=1
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT * FROM (SELECT 1)");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Multiple SELECT in SQL query.*mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_no_constraints.phpt b/tests/sql/mysqli_no_constraints.phpt
new file mode 100644
index 0000000..1d7fff6
--- /dev/null
+++ b/tests/sql/mysqli_no_constraints.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Mysqli connection test without any constraints
+--INI--
+extension=mysqli.so
+suhosin.sql.comment=0
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 AS A UNION SELECT 2 -- injection");
+$rows = $result->fetch_all();
+if ($rows !== null && count($rows) == 2) { echo "ok"; }
+
+?>
+--EXPECTF--
+ok
\ No newline at end of file
diff --git a/tests/sql/mysqli_open_comment.phpt b/tests/sql/mysqli_open_comment.phpt
new file mode 100644
index 0000000..29d3536
--- /dev/null
+++ b/tests/sql/mysqli_open_comment.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL open comment protection (/*...)
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=1
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 /*");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Open comment in SQL query.*mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_open_comment_fail.phpt b/tests/sql/mysqli_open_comment_fail.phpt
new file mode 100644
index 0000000..4645523
--- /dev/null
+++ b/tests/sql/mysqli_open_comment_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with SQL open comment protection (/*...) set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=2
+suhosin.sql.multiselect=0
+suhosin.sql.union=0
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 /*");
+flush();
+echo "mark.";
+?>
+--EXPECTREGEX--
+ALERT - Open comment in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/mysqli_union.phpt b/tests/sql/mysqli_union.phpt
new file mode 100644
index 0000000..9af9c61
--- /dev/null
+++ b/tests/sql/mysqli_union.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Mysqli query with UNION protection
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=1
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 UNION SELECT 2");
+flush();
+echo "mark.";
+
+?>
+--EXPECTREGEX--
+ALERT - UNION in SQL query.*mark.
\ No newline at end of file
diff --git a/tests/sql/mysqli_union_fail.phpt b/tests/sql/mysqli_union_fail.phpt
new file mode 100644
index 0000000..ee51a79
--- /dev/null
+++ b/tests/sql/mysqli_union_fail.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Mysqli query with UNION protection set to fail
+--INI--
+extension=mysqli.so
+suhosin.sql.bailout_on_error=0
+suhosin.sql.comment=0
+suhosin.sql.opencomment=0
+suhosin.sql.multiselect=0
+suhosin.sql.union=2
+suhosin.log.stdout=32
+--SKIPIF--
+<?php
+include('skipifmysqli.inc');
+include('skipif.inc');
+?>
+--FILE--
+<?php
+include('connect.inc');
+$mysqli = connect_mysqli_oostyle();
+$result = $mysqli->query("SELECT 1 UNION SELECT 2");
+echo "mark.";
+
+?>
+--EXPECTREGEX--
+ALERT - UNION in SQL query.*\)
\ No newline at end of file
diff --git a/tests/sql/skipifmysqli.inc b/tests/sql/skipifmysqli.inc
new file mode 100644
index 0000000..ee16cf1
--- /dev/null
+++ b/tests/sql/skipifmysqli.inc
@@ -0,0 +1,5 @@
+<?php
+if (!extension_loaded("mysqli")) {
+        die('skip - mysqli extension not available');
+}
+?>
\ No newline at end of file