Mysql comparison computation _ MySQL

Mysql comparison calculation bitsCN.com

5up3rh3iblog

You can see interesting things in the blog of menzhi007:

Http: // database/201003/45293 .html

In the mysql manual:

Phpchina.com/manual/mysql/functions.html?comparison-operators ">Http://www.phpchina.com/manual/mysql/functions.html#comparison-operators

MySQL compares values according to the following rules:

• If one or two parameters are NULL, the comparison result is NULL unless the NULL-safe <=> operator.
• If both parameters in the same comparison operation are strings, the comparison is performed based on strings.
• If both parameters are integers, compare them by integers.
• When the hexadecimal value does not need to be compared as a number, it is processed according to the binary string.
• If one of the parameters is a TIMESTAMP or DATETIME column, and the other parameters are constants, convert the constant to timestamp before comparison. This aims to make ODBC more smooth. Note that this is not suitable for parameters IN! To be more reliable, the complete datetime/date/time string is often used for comparison.
• In other cases, parameters are compared as floating point numbers.

By default, strings are case-insensitive and use existing character sets (cp1252 Latin1 by default ).

For comparison, you can use the CAST () function to convert a value to another type. CONVERT string values into different character sets using CONVERT. SeeSection 12.8 "Cast functions and operators".

The following example shows how to convert a string to a number in a comparison operation:

Mysql>SELECT 1> 6x;

-> 0

Mysql>SELECT 7> 6x;

-> 1

Mysql>SELECT 0> x6;

-> 0

Mysql>SELECT 0 = x6;

-> 1

If you do not pay attention to this, it can indeed cause security problems. for example, if the column in menzhi007 does not have quotation marks for character variable query, but some functions are used to filter out the column, you cannot inject it directly, then you can directly submit 0 to bypass...

At last, I would like to thank menzhi007 and the big cows in the hi group for their discussion, especially ryat's guidance :)

BitsCN.com