Simple establishment of database and front end and filtering injection parameters

Database configuration: News table under Sqlin

1. The simplest database connection, without any filtering, can be seen as a digital injection.

 ![](https://images2018.cnblogs.com/blog/1397720/201807/1397720-20180721114329440-1562257139.png)

Query the database, we only look at Sqlin here (also can look at other, because when connected root to the right)

Tabular

Check column

Content, from database. Table name

注意：当查询表名和列名的时候where table_name=’news’会报错，把news转化为16进制就好了。

2. Is-numeric () Filter for ID

3. Filter the Keywords Union,select,and,or ...

这个时候只要有select都会被换为空但是可以大小写不同绕过，比如SelECT过滤大小写用strtolower($id)函数解决大小写绕过或者直接用$id=str_ireplace("select","",$id);这个函数不区分大小写正则表达式确定绕过的对象

Simple establishment of database and front end and filtering injection parameters