SQL Injection code analysis

I carefully read the SQL Injection in dvwa and analyzed the cause. The following code provides the lowest security level:

<?phpif(isset($_GET['Submit'])){// Retrieve data$id = $_GET['id'];$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";$result = mysql_query($getid) or die('<pre>' . mysql_error() . '</pre>' );$num = mysql_numrows($result);$i = 0;while ($i < $num) {$first = mysql_result($result,$i,"first_name");$last = mysql_result($result,$i,"last_name");echo '<pre>';echo 'ID: ' . $id . '<br>First name: ' . $first . '<br>Surname: ' . $last;echo '</pre>';$i++;}}?>

 

In the beginning, only the submitted data is judged to be empty. If not empty, the data is directly imported into the query, resulting in SQL injection. Data is not filtered by any means. Attackers only need to enter non-empty data to inject data. Let's look at the moderate security-level code:

<?phpif (isset($_GET['Submit'])) {// Retrieve data$id = $_GET['id'];$id = mysql_real_escape_string($id);$getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";$result = mysql_query($getid) or die('<pre>' . mysql_error() . '</pre>' );$num = mysql_numrows($result);$i=0;while ($i < $num) {$first = mysql_result($result,$i,"first_name");$last = mysql_result($result,$i,"last_name");echo '<pre>';echo 'ID: ' . $id . '<br>First name: ' . $first . '<br>Surname: ' . $last;echo '</pre>';$i++;}}?>

 

The only improvement of this level is the conversion of symbols, but it cannot prevent our injection. The mysql_real_escape_string function is only used to escape some special symbols, such as the 'sign, which can be escaped directly. So that it cannot be injected. This is different from intermediate. Let's look at the advanced:

<?phpif (isset($_GET['Submit'])) {// Retrieve data$id = $_GET['id'];$id = stripslashes($id);$id = mysql_real_escape_string($id);if (is_numeric($id)){$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";$result = mysql_query($getid) or die('<pre>' . mysql_error() . '</pre>' );$num = mysql_numrows($result);$i=0;while ($i < $num) {$first = mysql_result($result,$i,"first_name");$last = mysql_result($result,$i,"last_name");echo '<pre>';echo 'ID: ' . $id . '<br>First name: ' . $first . '<br>Surname: ' . $last;echo '</pre>';$i++;}}}?>

 

In advanced mode, a newline symbol is removed, which is the concept of context .,