锟杰讹拷 web 锟斤拷锟斤拷锟斤拷没锟斤拷注锟解到 SQL 锟斤拷询锟角匡拷锟皆憋拷锟桔改的ｏ拷锟斤拷锟斤拷锟� SQL 锟斤拷询锟斤拷锟斤拷锟斤拷锟斤拷锟轿碉拷锟斤拷锟筋。锟解不知锟斤拷锟斤拷SQL 锟斤拷询锟斤拷锟斤拷锟狡匡拷锟斤拷锟绞匡拷锟狡ｏ拷锟接讹拷锟狡癸拷锟斤拷锟斤拷锟街わ拷锟饺拷藜锟介。锟斤拷锟斤拷锟斤拷锟竭ｏ拷锟叫匡拷锟斤拷通锟斤拷 SQL 锟斤拷询去锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷系统锟斤拷锟斤拷锟斤拷锟筋。
直锟斤拷 SQL 锟斤拷锟斤拷注锟斤拷锟斤拷枪锟斤拷锟斤拷叱锟斤拷玫锟揭伙拷执锟斤拷锟斤拷锟斤拷薷锟斤拷锟斤拷锟� SQL 锟斤拷锟侥硷拷锟斤拷锟斤拷锟接讹拷锟斤到取锟斤拷锟斤拷锟斤拷锟斤拷锟捷ｏ拷锟津覆盖关硷拷锟斤拷值锟斤拷锟斤拷锟斤拷执锟斤拷锟斤拷锟捷匡拷锟斤拷锟斤拷锟斤拷锟斤拷系统锟斤拷锟斤拷锟侥匡拷摹锟斤拷锟斤拷锟酵拷锟接︼拷贸锟斤拷锟饺★拷锟斤拷没锟斤拷锟斤拷氩拷刖蔡拷锟斤拷锟斤拷锟较筹拷 SQL 锟斤拷询锟斤拷实锟街的★拷锟斤拷锟芥将锟斤拷锟斤拷锟揭恍╋拷锟绞碉拷锟斤拷锟斤拷印锟�
锟斤拷锟斤拷锟斤拷缺锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷萁锟斤拷锟斤拷锟街わ拷锟斤拷锟斤拷锟绞癸拷锟斤拷顺锟斤拷锟斤拷没锟斤拷锟斤拷锟斤拷锟斤拷锟饺拷锟斤拷锟斤拷锟斤拷没锟斤拷锟斤拷锟斤拷菘锟斤拷屎锟斤拷锟斤拷锟斤拷樱锟斤拷锟斤拷锟斤拷呖锟斤拷锟斤拷锟斤拷锟斤拷菘锟斤拷锟斤拷陆锟揭伙拷锟斤拷锟斤拷锟斤拷没锟斤拷锟�
Example #1 一锟斤拷实锟斤拷锟斤拷锟捷凤拷页锟斤拷示锟侥达拷锟斤拷......也锟斤拷锟皆憋拷锟斤拷锟斤拷锟斤拷锟斤拷一锟斤拷锟斤拷锟斤拷锟矫伙拷锟斤拷PostgreSQL系统锟斤拷锟斤拷
<?php
$offset = $argv[0]; // 注锟解，没锟斤拷锟斤拷锟斤拷锟斤拷证锟斤拷
$query = "SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET $offset;";
$result = pg_query($conn, $query);
?>
0;
insert into pg_shadow(usename,usesysid,usesuper,usecatupd,passwd)
select 'crack', usesysid, 't','t','crack'
from pg_shadow where usename='postgres';
--
Note:
-- 锟斤拷 SQL 锟斤拷注锟酵憋拷牵锟揭伙拷锟斤拷锟斤拷使锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷 SQL 锟斤拷锟斤拷锟斤拷锟斤拷锟皆猴拷锟斤拷锟斤拷锟戒。
锟斤拷锟斤拷示锟斤拷锟斤拷锟斤拷锟斤拷锟揭筹拷锟斤拷锟斤拷锟斤拷锟揭伙拷锟斤拷艿玫锟斤拷锟斤拷锟侥匡拷锟叫办法锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷要锟斤拷锟斤拷只锟斤拷锟斤拷锟斤拷锟揭筹拷锟斤拷些锟结交锟斤拷去锟侥憋拷锟斤拷锟斤拷锟斤拷锟斤拷 SQL 锟斤拷洳拷掖锟斤拷锟斤拷锟斤拷摹锟斤拷锟斤拷锟斤拷锟侥憋拷锟斤拷通锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷 SELECT 锟斤拷询锟叫碉拷锟斤拷锟斤拷锟斤拷洌拷锟� WHERE, ORDER BY, LIMIT 锟斤拷 OFFSET锟斤拷锟斤拷锟斤拷锟斤拷菘锟街э拷锟� UNION 锟斤拷锟斤拷幕锟斤拷锟斤拷锟斤拷锟斤拷呋锟斤拷锟斤拷芑锟斤拷一锟斤拷锟斤拷锟斤拷锟斤拷 SQL 锟斤拷询锟斤拷锟接碉拷原锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷员锟斤拷锟斤拷锟斤拷锟斤拷锟捷憋拷锟叫得碉拷锟斤拷锟诫。锟斤拷耍锟斤拷锟斤拷锟斤拷锟斤拷侄渭锟斤拷锟斤拷呛锟斤拷锟揭拷摹锟�
Example #2 锟斤拷示锟斤拷锟斤拷......锟皆硷拷一些锟斤拷锟诫（锟轿猴拷锟斤拷锟捷匡拷系统锟斤拷
<?php
$query = "SELECT id, name, inserted, size FROM products
WHERE size = '$size'
ORDER BY $order LIMIT $limit, $offset;";
$result = odbc_exec($conn, $query);
?>
' union select '1', concat(uname||'-'||passwd) as name, '1971-01-01', '0' from usertable; --
SQL 锟叫碉拷 UPDATE 也锟斤拷锟杰碉拷锟斤拷锟斤拷锟斤拷锟斤拷锟街诧拷询也锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟津附硷拷锟斤拷锟斤拷一锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟襟。碉拷锟角癸拷锟斤拷锟竭革拷愿锟斤拷锟� SET 锟接撅拷锟斤拷锟街ｏ拷锟斤拷锟斤拷锟斤拷锟角就匡拷锟皆革拷锟斤拷锟斤拷锟捷憋拷锟叫碉拷一些锟斤拷锟捷★拷锟斤拷锟斤拷锟斤拷锟斤拷卤锟斤拷锟揭拷锟斤拷锟斤拷菘锟侥结构锟斤拷锟斤拷锟睫改诧拷询锟缴癸拷锟斤拷锟叫★拷锟斤拷锟斤拷通锟斤拷锟斤拷锟较的憋拷锟斤拷锟斤拷锟斤拷锟街段斤拷锟叫猜测，锟斤拷锟竭斤拷锟叫憋拷锟斤拷锟狡解。锟斤拷锟节达拷锟斤拷没锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟街段ｏ拷锟斤拷锟斤拷锟侥凤拷锟斤拷锟斤拷锟斤拷锟洁。
Example #3 锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷......锟斤拷锟斤拷酶锟斤拷锟饺拷蓿锟斤拷魏锟斤拷锟斤拷菘锟较低筹拷锟�
<?php
$query = "UPDATE usertable SET pwd='$pwd' WHERE uid='$uid';";
?>
<?php
// $uid == ' or uid like'%admin%'; --
$query = "UPDATE usertable SET pwd='...' WHERE uid='' or uid like '%admin%'; --";
// $pwd == "hehehe', admin='yes', trusted=100 "
$query = "UPDATE usertable SET pwd='hehehe', admin='yes', trusted=100 WHERE
...;";
?>
锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷碌锟斤拷锟斤拷咏锟斤拷锟斤拷锟绞撅拷锟斤拷锟斤拷某些锟斤拷锟捷匡拷锟斤拷执锟斤拷系统锟斤拷锟筋。
Example #4 锟斤拷锟斤拷锟斤拷锟捷匡拷锟斤拷锟斤拷锟斤拷锟斤拷锟侥诧拷锟斤拷系统锟斤拷MSSQL Server锟斤拷
<?php
$query = "SELECT * FROM products WHERE id LIKE '%$prod%'";
$result = mssql_query($query);
?>
<?php
$query = "SELECT * FROM products
WHERE id LIKE '%a%'
exec master..xp_cmdshell 'net user test testpass /ADD'--";
$result = mssql_query($query);
?>
Note:
锟斤拷然锟斤拷锟较碉拷锟斤拷锟斤拷锟斤拷锟斤拷锟侥骋伙拷囟锟斤拷锟斤拷锟斤拷菘锟较低筹拷模锟斤拷锟斤拷锟斤拷獠拷锟斤拷锟斤拷锟斤拷芏锟斤拷锟斤拷锟斤拷锟斤拷菘锟较低呈凳╋拷锟斤拷频墓锟斤拷锟斤拷锟绞癸拷貌锟酵拷姆锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷菘舛硷拷锌锟斤拷锟斤拷锟斤拷辍�
也锟斤拷锟斤拷锟剿伙拷锟斤拷锟揭帮拷慰锟斤拷说锟斤拷锟斤拷锟斤拷要知锟斤拷锟斤拷锟捷匡拷峁癸拷锟斤拷锟较拷锟斤拷锟绞凳╋拷锟斤拷锟侥癸拷锟斤拷锟斤拷没锟斤拷确实锟斤拷恕锟斤拷锟矫伙拷锟斤拷鼙锟街わ拷锟斤拷锟斤拷锟揭伙拷锟斤拷貌锟斤拷锟斤拷锟叫╋拷锟较拷锟揭伙拷锟斤拷锟斤拷堑玫锟斤拷耍锟斤拷锟斤拷菘锟斤拷锟叫孤讹拷锟轿ｏ拷铡锟斤拷锟斤拷锟斤拷锟斤拷锟矫匡拷锟斤拷源锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟捷库，锟斤拷锟斤拷锟斤拷坛锟斤拷锟津，癸拷锟斤拷锟竭就猴拷锟捷得碉拷锟斤拷锟斤拷氐拇锟斤拷搿ｏ拷锟斤拷锟斤拷些锟斤拷锟斤拷锟斤拷撇锟斤拷锟斤拷幕锟斤拷锟斤拷锟斤拷站透锟斤拷锟斤拷恕锟�
锟斤拷些锟斤拷锟斤拷锟斤拷锟角斤拷锟斤拷锟节凤拷锟斤拷全锟斤拷识锟斤拷强锟侥达拷锟斤拷锟较的★拷锟斤拷锟皆ｏ拷锟斤拷远锟斤拷要锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟捷ｏ拷锟截憋拷锟斤拷锟斤拷锟斤拷锟节客伙拷锟剿的ｏ拷锟斤拷锟斤拷选锟斤拷颉⒈锟斤拷锟斤拷锟斤拷锟斤拷 cookie锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷牡锟揭伙拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷牟锟窖诧拷锌锟斤拷锟斤拷锟斤拷锟斤拷锟窖★拷
锟斤拷锟斤拷锟斤拷锟饺达拷锟斤拷锟斤拷一锟斤拷锟斤拷锟街ｏ拷锟斤拷锟皆匡拷锟斤拷使锟斤拷 is_numeric() 锟斤拷锟斤拷椋拷锟斤拷锟街憋拷锟绞癸拷锟� settype() 锟斤拷转锟斤拷锟斤拷锟斤拷锟斤拷锟酵ｏ拷也锟斤拷锟斤拷锟斤拷 sprintf() 锟斤拷锟斤拷锟斤拷式锟斤拷为锟斤拷锟街★拷
Example #5 一锟斤拷实锟街凤拷页锟斤拷锟斤拷全锟侥凤拷锟斤拷
<?php
settype($offset, 'integer');
$query = "SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET $offset;";
// 锟斤拷注锟斤拷锟绞斤拷址锟斤拷锟斤拷械锟� %d锟斤拷锟斤拷锟斤拷锟� %s 锟酵猴拷锟斤拷锟斤拷锟斤拷锟斤拷
$query = sprintf("SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET %d;",
$offset);
?>
锟斤拷锟斤拷之锟解，锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟铰ｏ拷使锟矫达拷锟斤拷锟斤拷锟斤拷菘锟较低筹拷锟斤拷锟斤拷询锟斤拷志也锟斤拷一锟斤拷锟矫办法锟斤拷锟斤拷然锟斤拷锟斤拷志锟斤拷锟斤拷锟杰凤拷止锟轿何癸拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟皆革拷锟劫碉拷锟侥革拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟皆癸拷锟斤拷锟斤拷锟斤拷锟斤拷志锟斤拷锟斤拷没锟矫ｏ拷要锟斤拷锟斤拷锟斤拷锟叫帮拷锟斤拷锟斤拷锟斤拷息锟斤拷锟叫★拷锟较撅拷锟斤拷锟斤拷锟斤拷锟斤拷锟较拷鼙锟矫伙拷锟揭拷谩锟�