Introduction to SQL injection and XSS attacks in PHP

mysql_connect ("localhost", "root", "123456") or Die ("Database connection failed!"); mysql_select_db ("Test1"); $user =$_post[' uid ']; $pwd =$_post[' pass '; if (mysql_query ("SELECT * from where Admin = ' username ' = ' $user ' or ' password ' = ' $pwd ') { echo "user successfully logged in."; } eles { echo "Error in User name or password"; } ?> Copy Code The above code is used to detect whether the user name or password is correct, but some malicious attackers to submit some sensitive code, the consequences are conceivable. There are 2 ways to inject post judgment . 1, in the Form form text box input "or ' 1 ' = 1" or "and 1=1" in the query database statement should be: SELECT admin from where login = ' user ' = ' or ' 1 ' =1 ' or ' pass ' = ' XXXX ' certainly does not appear to be anything wrong, because or in the statement of SQL represents and, or meaning. Of course the error is also indicated. At that time, we had discovered that we could query all the information of the current table after executing the SQL statement. For example: Correct administrator account and password for login intrusion. Fix It 1: Use JavaScript scripts to filter special characters (not recommended) If the attacker disables JavaScript or can make a SQL injection attack. Fix it 2: Use MySQL's own function to filter. Omitting operations such as connecting to a database $user =mysql_real_escape_string ($_post[' user '); mysql_query ("select * from admin whrer ' username ' = ' $user '"); ?> Copy Code 2, XSS attacks and prevention. Submit a form: Copy Code Receive file: if (Empty ($_post[' Sub '])) { echo $_post[' test ']; } Copy Code The code is simple, just simulating the next usage scenario. 3. Join the attacker to submit the cookie information of the current page should be displayed on the returned page. We can apply to some of the message boards (not filtered in advance), and then when the administrator reviews the change of information to steal cookie information, and sent to the attacker's space or mailbox. An attacker could use a cookie modifier to log in and invade. The following describes one of the most common workarounds. Fix Scenario 1: Use JavaScript for escape repair Scenario 2: Escaping with PHP built-in functions if (Empty ($_post[' Sub '])) { $str =$_post[' test ']; Htmlentities ($SRT); Echo $srt; } Copy Code

