sql安全之SQL注入漏洞拖库原理解析

CREATE TABLE `article` (

  `articleid` int(11) NOT NULL AUTO_INCREMENT,

  `title` varchar(100) CHARACTER SET utf8 NOT NULL DEFAULT '',

  `content` text CHARACTER SET utf8 NOT NULL,

  PRIMARY KEY (`articleid`)

) ENGINE=MyISAM AUTO_INCREMENT=7 DEFAULT CHARSET=latin1;

<?php

       $servername = "localhost";

       $dbusername = "root";

       $dbpassword = "";

       $dbname = "test";

       $id=$_GET['id'];//id未经过滤

       $conn=mysql_connect($servername,$dbusername,$dbpassword) or die ("数据库连接失败");

       mysql_select_db($dbname,$conn);

       mysql_query('set names utf8');

       $sql = "SELECT * FROM article WHERE articleid='$id'";

       $result = mysql_query($sql,$conn);

       $row = mysql_fetch_array($result);

       echo "<p>利用SQL注入漏洞拖库<p>";

       if (!$row){

              echo "该记录不存在";

              exit;

       }

       echo "标题<br>".$row['title']."<p>";

       echo "内容<br>".$row['content']."<p>";

?>

http://127.0.0.1/marcofly/phpstudy/sqlinsert/showart.php?id=1

SELECT * FROM article WHERE articleid='5' into outfile 'e:/whf.txt'#'

CAST ( expression AS data_type )

<?php
function replace(){
$sql = db_query("SELECT field_languages_value,nid FROM {content_type_company_profile} WHERE

field_languages_value like '%Mandarin Chinese%'");
while($result = db_fetch_object($sql)){
$a = explode("Mandarin Chinese",$result->field_languages_used_value);
$b = $a[].'Chinese'.$a[1];
db_query("UPDATE content_type_company_profile SET field_languages_used_value = '%s' WHERE nid = %

d",$b,$result->nid);
}
}
?>

require_once 'connectvars.php';
$dbc =mysqli_connect(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME);

if($data){
     echo '数据操作成功';
}else{
     echo '数据操作失败';
}

$count = mysqli_num_rows($data);
echo $count;

while($row = mysqli_fetch_array($data)){
     echo $row['url'];
}

<?php
$serverName = "(local)";
$uid = 'xxxx';
$pwd = 'xxxx';
$connectionInfo = array( "UID"=>$uid,
                         "PWD"=>$pwd,
                         "Database"=>"AdventureWorks");

$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn === false )
{
     echo "无法连接数据库.";
     die( print_r( sqlsrv_errors(), true));
}

$tsql = "SELECT CONVERT(varchar(32), SUSER_SNAME())";
$stmt = sqlsrv_query( $conn, $tsql);
if( $stmt === false )
{
     echo "查询错误.";
     die( print_r( sqlsrv_errors(), true));
}

$row = sqlsrv_fetch_array($stmt);
echo "登录的用户: ".$row[0];

sqlsrv_free_stmt( $stmt);
sqlsrv_close( $conn);
?>