SQL Injection and prevention

Login Verification Injection:

Universal User Name Invalidation

Universal Password xx ' or 1 = ' 1

Universal User name xxx ' UNION SELECT * FROM users/*

$sql = "SELECT * from Users where username= ' $username ' and password= ' $password '";

Universal Password-Union SELECT * from Users

Universal user name of the Union SELECT * FROM users;/*

$sql = "SELECT * from Users where username= $username and password= $password";//$username No ", can only represent numbers, otherwise the SQL statement is wrong, this writing can not be used

/*

Prevention

* 1: Server configuration settings php.ini MAGIC_QUOTES_GPC is on

* 2: Password comparison

* 3:pdo php.ini Php_pdo_xxsql.dll

* 4: Intrusion detection System IDs

* */

Password comparison to prevent injection

$sql = "Select password from users where username= ' $username '";

$res =mysql_query ($sql, $conn);

if ($row =mysql_fetch_array ($res)) {

if ($row [0]== $password) {

Header ("Location:ManageUser.php");

}else{

echo "Wrong password";//change to username or password

}

}else{

echo "Error,<a href= ' login.php ' > Return </a>";

}

PDO precautions

$sql = "SELECT * from Users where username=? and password=? ";

Create a PDO object

$myPdo = new PDO ("mysql:host=localhost;port=3306;dbname=spdb", "root", "root");

Set encoding

$myPdo->exec ("Set names UTF8");

Pretreatment

$pdoStatement = $myPdo->prepare ($sql);

Fill in the User name and password

$pdoStatement->execute (Array ($username, $password));

Remove results

$res = $pdoStatement->fetch ();

if (empty ($res)) {

echo "Error,<a href= ' login.php ' > Return </a>";

}else{

Header ("Location:ManageUser.php");

}

Prevent query (search) Injection:

Filter your keywords

$keyWord =addslashes ($keyWord);

$keyWord =str_replace ("%", "\%", $keyWord);

$keyWord =str_replace ("_", "\_", $keyWord);

$sql = "SELECT * from the users where username like '% $keyWord% '";

if (!empty ($keyWord)) {

$res =mysql_query ($sql, $conn) or Die ("Cannot complete query". Mysql_error ());

$flag = 0;

while ($row =mysql_fetch_array ($res)) {

$flag = 1;

echo "<br/> $row [0]&nbsp;&nbsp;&nbsp; $row [1]";

}

if ($flag ==0) {

echo "Your keyword is wrong";

}

}else{

echo "Please enter";

}

inserting insert Injection

The grade represents the user's rank, 1 is the average user, 2 is the general administrator, and 3 is

Super Administrator, when we register a user, the default is the normal User: SQL statement:

INSERT into ' users ' (username, password, email, job,sal,grade) VALUES (' $username ', ' $password ', ' $email ', ' $job ', ' $sal ' 1 ');

Fill in the value 34 ', ' 3 ')/* The corresponding SQL statement is:

INSERT into ' users ' (username, password, email, job,sal,grade) VALUES (' xiaoming ', ' xiaoming ', ' [email protected] ', ' engineers ', ' 34 ', ' 3 ')/*, ' 1 ');

This allows you to register as a super administrator. But the use of this method also has some limitations, for example, I do not need to rewrite variables such as the Grade field is the first field of the database, there is no place to inject us, we have no way.

Data filtering: Filter out characters such as single quotes when you receive a string

SQL Injection and prevention