MAGIC_QUOTE_GPC function on understanding in php.ini

Nonetheless, the attacker still had the opportunity to perform a SQL injection attack ... The premise is that when the parameter is numeric and not processed by the intval () function, because after the processing of intval (), all data is coerced into numbers.

As mentioned earlier, when Magic_quote_gpc=on is turned on, it is equivalent to using the Addslshes () function. But the numeric type does not use single quotes, so it's a matter of course to bypass the addslshes () function conversion. Using MySQL's own char () function or hex (), char () can interpret parameters as integers and return a string of ASCII code characters for these integers, which means that you must precede the number with 0x.

Example Demo:

Suppose we know that the admin username is admin and the password is not known. And the MAGIC_QUOTE_GPC has been enabled.

SQL statement:

The code is as follows	Copy Code
$sql = "SELECT * from Users where username= $name and password= ' $pwd '";

Note: The variable $name is not quoted

At this point, enter username=admin%23 in the Address bar, and the synthesized SQL statement is:

　　

The code is as follows	Copy Code
SELECT * from users where username= ' admin ' # ' and password= ';

The single quotation mark (') entered through the URL address bar will be prefixed with a backslash, which will invalidate the SQL statement.

Admin converted to ASCII is char (97,100,109,105,110)

Enter in the address bar at this time

The code is as follows	Copy Code
Username=char (97,100,109,105,110)%23

The SQL statement becomes:

　　

The code is as follows	Copy Code
SELECT * from Users where Username=char (97,100,109,105,110) # ' and password= ';

The results of the implementation of the true, you can smoothly into the background.

For a digital injection attack, it is necessary to use Intval () to cast the parameter to a number before any numeric parameter is put into the database, thus eliminating the emergence of a digital injection vulnerability.

Like what:

The code is as follows	Copy Code
$id =intval ($_get[' id ')); SELECT * from articles where id= ' $id ';

Enter the Address bar:

The code is as follows	Copy Code
Id=5 ' or 1=1%23

The SQL statement becomes:

The code is as follows	Copy Code
SELECT * from articles where id= ' 5 '; Instead of the select * from articles where id= ' 5 ' or 1=1#;

Summarize:

For each variable, remember to enclose a single quote, such as where username= ' $name ',
opening MAGIC_QUOTE_GPC is not absolutely safe, and for digital injection attacks, it is not enough to use the addslashes () function for conversion. You also use Intval () to force the parameters to be converted to numbers