SQL Injection attacks are specially crafted SQL statements submitted by attackers in the form to modify the original SQL statements. If the web program does not check the submitted data, this will cause SQL injection attacks.
General steps for SQL injection attacks:1. attackers access websites with SQL injection vulnerabilities to find injection points. 2. Attackers construct injection statements, the injection statement is combined with the SQL statement in the program to generate a new SQL statement 3. The new SQL statement is submitted to the database for processing 4. The database executes the new SQL statement, triggering an SQL injection attack
650) this. width = 650; "title =" 1.png" src = "http://www.bkjia.com/uploads/allimg/131228/1435133b3-0.png" style = "padding: 0px; margin: 0px; vertical-align: top; border: none; float: none; "alt =" 203600942.png"/>
Instance
Database create table 'postmessage' ('id' int (11) not null auto_increment, 'subobject' varchar (60) not null default ", 'name' varchar (40) not null default ", 'email 'varchar (25) not null default", 'Question 'mediumtext not null, 'postdate' datetime not null default '2017-00-00 00:00:00 ′, primary key ('id') ENGINE = MyISAM default charset = gb2312 COMMENT = 'caller's message 'AUTO_INCREMENT = 69; grant all privileges o N ch3. * to 'sectop' @ localhost identified by '000000'; // add. php Insert Message // list. php message list // show. php Display message page http://www.netsos.com.cn/show.php? Id = 71 there may be injection points, let's test the http://www.netsos.com.cn/show.php? Id = 71 and 1 = 1
650) this. width = 650; "title =" 2.png" src = "http://img1.51cto.com/attachment/201308/203603611.png" width = "650" style = "padding: 0px; margin: 0px; vertical-align: top; border: none; float: none; "alt =" 203603611.png"/>
650) this. width = 650; "title =" 3.png" src = "http://img1.51cto.com/attachment/201308/203605740.png" width = "650" style = "padding: 0px; margin: 0px; vertical-align: top; border: none; float: none; "alt =" 203605740.png"/>
Once the record is found, once not, let's look at the source code // show. php 12-15 rows // execute the mysql query statement $ query = "select * from postmessage where id = ". $ _ GET ["id"]; $ result = mysql_query ($ query) or die ("An error occurred while executing the ySQL query statement :". mysql_error (); after the parameter id is passed in, the SQL statement combined with the preceding string is put into the database for query submission and 1 = 1, the statement is changed to select * from postmessage where id = 71 and 1 = 1. Both the values before and after the statement are true, and the query data is submitted and 1 = 2, the statement is changed to select * from postmessage where id = 71 and 1 = 2. The value before the statement is true, the value after the statement is false, and the value after the statement is false. The query is not SQL injection attacks are formed after the statements we construct to query normal data. Through this injection point, we can further obtain permissions, such as using union to read management passwords, read database information, or using functions such as mysql load_file and into outfile to further penetrate.
Defense methods
Integer parameter: Use the intval function to convert data to an integer. The int intval (mixed var, int base) var is the base variable to be converted to an integer. (optional) It is the base number, the default value is 10 floating-point parameters. The floatval and doubleval functions are used to convert Single-precision and double-precision floating-point parameters respectively. The int floatval (mixed var) var is the variable to be converted. int doubleval (mixed var) var is the variable type parameter to be converted: Use the addslashes function to convert the single quotation mark "'" to "\", and the double quotation mark "" to "\" ". the Backslash "\" is converted to "\", and the NULL character is added with the Backslash "\" function prototype string addslashes (string str) str is the string to be checked, so we can fix the code vulnerability just now. // execute the mysql query statement $ query = "select * from postmessage where id = ". intval ($ _ GET ["id"]);
$ Result = mysql_query ($ query)
Or die ("failed to execute the ySQL query statement :". mysql_error (); if it is a struct type, first determine that magic_quotes_gpc cannot be On. if it is not On, use addslashes to escape special characters if (get_magic_quotes_gpc ())
{
$ Var = $ _ GET ["var"];
}
Else
{
$ Var = addslashes ($ _ GET ["var"]);
} Test again. The vulnerability has been fixed !!! OK! Although many PHP programmers in China are still relying on addslashes to prevent SQL injection, we recommend that you enhance Chinese characters to prevent SQL Injection checks. The problem with addslashes is that hackers can use 0xbf27 to replace single quotes, while addslashes only changes 0xbf27 to 0xbf5c27 to a valid multi-byte character, where 0xbf5c is still considered as single quotes, therefore, addslashes cannot be intercepted. Of course, addslashes is not useless either. It is used for processing single-byte strings and mysql_real_escape_string is used for multi-byte characters. Open magic_quotes_gpc to prevent SQL injection into php. in ini, magic_quotes_gpc = Off is disabled by default. If it is enabled, the user is automatically submitted to convert the SQL query, for example, converting ', it plays a major role in preventing SQL injection. If magic_quotes_gpc = Off, use the addslashes () function. The example code for get_magic_quotes_gpc in the php manual is as follows: if (! Get_magic_quotes_gpc () {$ lastname = addslashes ($ _ POST ['lastname']);} else {$ lastname = $ _ POST ['lastname'];} if magic_quotes_gpc is enabled, check $ _ POST ['lastname. In addition, the differences between mysql_real_escape_string and mysql_escape_string are: mysql_real_escape_string must be used only when (PHP 4> = 4.3.0, PHP 5. Otherwise, only mysql_escape_string can be used. The difference between mysql_real_escape_string and mysql_escape_string is not considered because of the current character set to be connected. 1) mysql_real_escape_string -- escape special characters in the strings used in SQL statements, and take into account the usage of the connected current character set as follows: $ SQL = "select count (*) as ctr from users where username02. = '". mysql_real_escape_string ($ username ). "'and 03. password = '". mysql_real_escape_string ($ pw ). "'limit 1"; UDF inject_check ($ SQL _str) {return eregi ('select | insert | and | or | update | delete | '|/* | .. /|. /| union | into | load_file | outfile ', $ SQL _str);} function verify_id ($ Id = null) {if (! $ Id) {exit ('no submission parameter! ');} Elseif (inject_check ($ id) {exit ('the submitted parameter is invalid! ');} Elseif (! Is_numeric ($ id) {exit ('the submitted parameter is invalid! ') ;}$ Id = intval ($ id); return $ id;} function str_check ($ str) {if (! Get_magic_quotes_gpc () {$ str = addslashes ($ str); // filter} $ str = str_replace ("_", "_", $ str ); $ str = str_replace ("%", "%", $ str); return $ str;} function post_check ($ post) {if (! Get_magic_quotes_gpc () {$ post = addslashes ($ post);} $ post = str_replace ("_", "_", $ post ); $ post = str_replace ("%", "%", $ post); $ post = nl2br ($ post); $ post = htmlspecialchars ($ post); return $ post ;} these website code modifications can also be used with some anti-injection tools. For example, the dongle from the dongle lab is very powerful in anti-injection, it can stop a lot of intruders. Some anti-injection tools are also very powerful. You can try them! END !!!
This article from the "xy low-key development" blog, please be sure to keep this source http://qq7887174.blog.51cto.com/7898352/1301741
