Sqli-labs less 36

Less-36

We directly see the source code for 36 off.

The Check_quotes () function above is filtered using the mysql_real_escape_string () function.

The mysql_real_escape_string () function escapes special characters in strings used in SQL statements.

The following characters are affected:

• \x00
• \ n
• \ r
• ‘
• "
• \x1a

If successful, the function returns the escaped string. If it fails, it returns false.

But because MySQL we did not set into GBK, so mysql_real_escape_string () can still be broken. The method is the same as above.

Payload:

Http://127.0.0.1/sqli-labs/Less-36/?id=-1%EF%BF%BD%27union%20select%201,user (), 3--+

We use the ' utf-16 to make breakthroughs, we can also make use of%DF.

Payload:

Http://127.0.0.1/sqli-labs/Less-36/?id=-1%df%27union%20select%201,user (), 3--+

?

Notice:

When using mysql_real_escape_string (), how to safely protect this problem requires MySQL to be set to GBK.

Setup code:

Mysql_set_charset (' GBK ', ' $conn ')

Sqli-labs less 36