Learning notes HTTP parameter pollution injection

HTTP parameter pollution injection originates from the different ways that the Web site handles the same parameters that are submitted.

For example:

Www.XX.com/a?key=ab&key=3

If the server returns the value of the input key, there may be

One: AB

Two: 3

Three: Ad3

These are three different ways.

Specific service-side processing methods are as follows:

Web server	Parameter Get function	The parameters that are obtained
Php/apache	$_get ("par")	Last
Jsp/tomcat	Request.getparameter ("par")	First
Perl (CGI)/apache	Param ("par")	First
Python/apache	Getvalue ("par")	All (List)
Asp/iis	Request.QueryString ("par")	All (comma-delimited string)

Assuming input www.xx.com/a?key=select&key=1,2,3,4 from table

The server may handle the key as a select 1,2,3,4 from table, resulting in SQL injection.

Learning notes HTTP parameter pollution injection