Common SQL injection methods
WEB Security SQL Injection
Introduction:
When developing a website, for security reasons, it is necessary to filter the characters passed from the page. Usually, users can call the content of the database through the following interfaces: URL address bar, login interface, message board, search box, etc. This often leaves opportunities for hackers to take advantage of. At worst, the data may be leaked, and at worst, the server may be taken down.
1. SQL injection steps
a) Find the injection point and construct a special statement
The controllable parameters of the incoming SQL statement are divided into two categories
1. For numeric types, parameters do not need to be enclosed in quotation marks, such as ?id=1
2. For other types, parameters must be enclosed in quotation marks, such as?name="phone"
b) The user constructs a SQL statement (such as: 'or 1=1#;admin'# (this injection is also called PHP's universal password, which can bypass entering the password when the user name is known). I will explain it later)
c) Send the SQL statement to the DBMS database
d) DBMS receives the returned result, interprets the request into machine code instructions, and performs the necessary operations
e) DBMS Accept the returned result, process it, and return it to the user
Because the user constructs a special SQL statement, special results must be returned (as long as your SQL statement is flexible enough)
Below, I pass a Examples to demonstrate SQL injection in detail
2. Detailed explanation of SQL injection examples (the above tests assume that magic_quote_gpc is not turned on on the server)
1) Preliminary preparations
Let’s demonstrate first SQL injection vulnerability, log in to the backend administrator interface
First, create a data table for testing:
CREATE TABLE `users` ( `id` int(11) NOT NULL AUTO_INCREMENT, `username` varchar(64) NOT NULL, `password` varchar(64) NOT NULL, `email` varchar(64) NOT NULL,PRIMARY KEY (`id`),UNIQUE KEY `username` (`username`) ) ENGINE=MyISAM AUTO_INCREMENT=3 DEFAULT CHARSET=latin1;
Add a record for testing:
INSERT INTO users (username,password,email)VALUES('MarcoFly',md5('test'),'marcofly@test.com');
Next, paste the login The source code of the interface
<html>
<head>
<title>Sql注入演示</title>
<meta http-equiv="content-type" content="text/html;charset=utf-8" />
</head>
<body>
<form action="validate.php" method="post">
<fieldset>
<legend>Sql注入演示</legend>
<table>
<tbody>
<tr>
<td>用户名：</td>
<td><input type="text" name="username" /></td>
</tr>
<tr>
<td>密 码：</td>
<td><input type="text" name="password" /></td>
</tr>
<tr>
<td><input type="submit" value="提交" /></td>
<td><input type="reset" value="重置" /></td>
</tr>
</tbody>
</table>
</fieldset>
</form>
</body>
</html>Attached is the rendering:
When the user clicks the submit button, the form data will be submitted to the validate.php page , the validate.php page is used to determine whether the user name and password entered by the user meet the requirements (this step is very important, and is often the location of SQL vulnerabilities)
! <!--前台和后台对接-->
<html>
<head>
<title>登录验证</title>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
</head>
<body>
<?php
$conn=@mysql_connect("localhost",'root','') or die("数据库连接失败！");;
mysql_select_db("injection",$conn) or die("您要选择的数据库不存在");
$name=$_POST['username'];
$pwd=$_POST['password'];
$sql="select * from users where username='$name' and password='$pwd'";
$query=mysql_query($sql);
$arr=mysql_fetch_array($query);
if(is_array($arr)){
header("Location:manager.php");
}else{
echo "您的用户名或密码输入有误，<a href=\"Login.php\">请重新登录！</a>";
}
?>
</body>
</html>Have you noticed it? We will submit the user directly. The data (user name and password) are directly executed, and special character filtering is not implemented. You will understand later that this is fatal.
Code analysis: If the username and password match successfully, it will jump to the administrator operation interface (manager.php). If it fails, a friendly prompt message will be given.
Successful login interface:
Login failure prompt:
At this point, the preliminary work has been done Okay, next we will start our highlight: SQL injection
2) Construct SQL statement
After filling in the correct user name (marcofly) and password (test), click Submit, and it will be returned to Our "Welcome Administrator" interface.
Because the username and password we submitted are synthesized into the SQL query statement like this:
select * from users where username='marcofly' and password=md5('test')
Obviously, the username and password are the same as what we gave before , you will definitely be able to log in successfully. But what if we enter a wrong username or password? Obviously, I definitely can’t log in. Well, this is the case under normal circumstances, but for websites with SQL injection vulnerabilities, as long as a special "string" is constructed, you can still log in successfully.
For example: enter: ' or 1=1# in the user name input box, enter the password casually, the synthesized SQL query statement at this time is:
select * from users where username='' or 1=1#' and password=md5('')
Semantic analysis: "#" is a comment character in mysql, so the content after the pound sign will be regarded as comment content by mysql, so it will not be executed. In other words, the following two sql statements, etc. Valence:
select * from users where username='' or 1=1#' and password=md5('')
is equivalent to
select* from users where usrername='' or 1=1
because 1=1 is always true, that is, the where clause is always true. After further simplifying the sql, etc. The value is the following select statement:
select * from users
Yes, the function of this sql statement is to retrieve all fields in the users table
The above is an input method, here is another one Injection method, this method is also called PHP's universal password
If we know the user name, we can log in without a password. Suppose the user name is: admin
Construct the statement:
select * from users where username='admin'#' and password=md5('')
is equivalent to
select * from users where username='admin'
so that you can log in without entering a password.
The database will mistakenly think that you can log in without a user name, bypassing the background verification and achieving the purpose of injection.
also exploits vulnerabilities in SQL syntax.
See, a constructed SQL statement can have such terrible destructive power. I believe that after seeing this, you will begin to have a rational understanding of SQL injection~
Yes, SQL injection It's that easy. However, it is not so easy to construct flexible SQL statements according to the actual situation. After you have the basics, you can slowly explore on your own.
Have you ever thought about what if the data submitted through the background login window are filtered out by the administrator with special characters? In this case, our universal username' or 1=1# cannot be used. But this does not mean that we have no countermeasures. We must know that there is more than one way for users to interact with the database.
Recommended: "mysql tutorial"
The above is the detailed content of Common SQL injection methods. For more information, please follow other related articles on the PHP Chinese website!
How does MySQL index cardinality affect query performance?Apr 14, 2025 am 12:18 AMMySQL index cardinality has a significant impact on query performance: 1. High cardinality index can more effectively narrow the data range and improve query efficiency; 2. Low cardinality index may lead to full table scanning and reduce query performance; 3. In joint index, high cardinality sequences should be placed in front to optimize query.
MySQL: Resources and Tutorials for New UsersApr 14, 2025 am 12:16 AMThe MySQL learning path includes basic knowledge, core concepts, usage examples, and optimization techniques. 1) Understand basic concepts such as tables, rows, columns, and SQL queries. 2) Learn the definition, working principles and advantages of MySQL. 3) Master basic CRUD operations and advanced usage, such as indexes and stored procedures. 4) Familiar with common error debugging and performance optimization suggestions, such as rational use of indexes and optimization queries. Through these steps, you will have a full grasp of the use and optimization of MySQL.
Real-World MySQL: Examples and Use CasesApr 14, 2025 am 12:15 AMMySQL's real-world applications include basic database design and complex query optimization. 1) Basic usage: used to store and manage user data, such as inserting, querying, updating and deleting user information. 2) Advanced usage: Handle complex business logic, such as order and inventory management of e-commerce platforms. 3) Performance optimization: Improve performance by rationally using indexes, partition tables and query caches.
SQL Commands in MySQL: Practical ExamplesApr 14, 2025 am 12:09 AMSQL commands in MySQL can be divided into categories such as DDL, DML, DQL, DCL, etc., and are used to create, modify, delete databases and tables, insert, update, delete data, and perform complex query operations. 1. Basic usage includes CREATETABLE creation table, INSERTINTO insert data, and SELECT query data. 2. Advanced usage involves JOIN for table joins, subqueries and GROUPBY for data aggregation. 3. Common errors such as syntax errors, data type mismatch and permission problems can be debugged through syntax checking, data type conversion and permission management. 4. Performance optimization suggestions include using indexes, avoiding full table scanning, optimizing JOIN operations and using transactions to ensure data consistency.
How does InnoDB handle ACID compliance?Apr 14, 2025 am 12:03 AMInnoDB achieves atomicity through undolog, consistency and isolation through locking mechanism and MVCC, and persistence through redolog. 1) Atomicity: Use undolog to record the original data to ensure that the transaction can be rolled back. 2) Consistency: Ensure the data consistency through row-level locking and MVCC. 3) Isolation: Supports multiple isolation levels, and REPEATABLEREAD is used by default. 4) Persistence: Use redolog to record modifications to ensure that data is saved for a long time.
MySQL's Place: Databases and ProgrammingApr 13, 2025 am 12:18 AMMySQL's position in databases and programming is very important. It is an open source relational database management system that is widely used in various application scenarios. 1) MySQL provides efficient data storage, organization and retrieval functions, supporting Web, mobile and enterprise-level systems. 2) It uses a client-server architecture, supports multiple storage engines and index optimization. 3) Basic usages include creating tables and inserting data, and advanced usages involve multi-table JOINs and complex queries. 4) Frequently asked questions such as SQL syntax errors and performance issues can be debugged through the EXPLAIN command and slow query log. 5) Performance optimization methods include rational use of indexes, optimized query and use of caches. Best practices include using transactions and PreparedStatemen
MySQL: From Small Businesses to Large EnterprisesApr 13, 2025 am 12:17 AMMySQL is suitable for small and large enterprises. 1) Small businesses can use MySQL for basic data management, such as storing customer information. 2) Large enterprises can use MySQL to process massive data and complex business logic to optimize query performance and transaction processing.
What are phantom reads and how does InnoDB prevent them (Next-Key Locking)?Apr 13, 2025 am 12:16 AMInnoDB effectively prevents phantom reading through Next-KeyLocking mechanism. 1) Next-KeyLocking combines row lock and gap lock to lock records and their gaps to prevent new records from being inserted. 2) In practical applications, by optimizing query and adjusting isolation levels, lock competition can be reduced and concurrency performance can be improved.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
MantisBT
Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.
Atom editor mac version download
The most popular open source editor
SublimeText3 Linux new version
SublimeText3 Linux latest version
DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software
mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),
