search
HomeDatabaseMysql Tutorial在PHP中全面阻止SQL注入式 攻击之二_MySQL

bitsCN.com

  一、 注入式攻击的类型

  可能存在许多不同类型的攻击动机,但是乍看上去,似乎存在更多的类型。这是非常真实的-如果恶意用户发现了一个能够执行多个查询的办法的话。本文后面,我们会对此作详细讨论。

  如果你的脚本正在执行一个SELECT指令,那么,攻击者可以强迫显示一个表格中的每一行记录-通过把一个例如"1=1"这样的条件注入到WHERE子句中,如下所示(其中,注入部分以粗体显示):

SELECT * FROM wines WHERE variety = 'lagrein' OR 1=1;'

  正如我们在前面所讨论的,这本身可能是很有用的信息,因为它揭示了该表格的一般结构(这是一条普通的记录所不能实现的),以及潜在地显示包含机密信息的记录。

  一条更新指令潜在地具有更直接的威胁。通过把其它属性放到SET子句中,一名攻击者可以修改当前被更新的记录中的任何字段,例如下面的例子(其中,注入部分以粗体显示):

UPDATE wines SET type='red','vintage'='9999' WHERE variety = 'lagrein'

  通过把一个例如1=1这样的恒真条件添加到一条更新指令的WHERE子句中,这种修改范围可以扩展到每一条记录,例如下面的例子(其中,注入部分以粗体显示):

UPDATE wines SET type='red','vintage'='9999 WHERE variety = 'lagrein' OR 1=1;'

  最危险的指令可能是DELETE-这是不难想像的。其注入技术与我们已经看到的相同-通过修改WHERE子句来扩展受影响的记录的范围,例如下面的例子(其中,注入部分以粗体显示):

DELETE FROM wines WHERE variety = 'lagrein' OR 1=1;'

  二、 多个查询注入

  多个查询注入将会加剧一个攻击者可能引起的潜在的损坏-通过允许多条破坏性指令包括在一个查询中。在使用MySQL数据库时,攻击者通过把一个出乎意料之外的终止符插入到查询中即可很容易实现这一点-此时一个注入的引号(单引号或双引号)标记期望变量的结尾;然后使用一个分号终止该指令。现在,一个另外的攻击指令可能被添加到现在终止的原始指令的结尾。最终的破坏性查询可能看起来如下所示:

SELECT * FROM wines WHERE variety = 'lagrein';
GRANT ALL ON *.* TO 'BadGuy@%' IDENTIFIED BY 'gotcha';'

  这个注入将创建一个新的用户BadGuy并赋予其网络特权(在所有的表格上具有所有的特权);其中,还有一个"不祥"的口令被加入到这个简单的SELECT语句中。如果你遵循我们在以前文章中的建议-严格限制该过程用户的特权,那么,这应该无法工作,因为web服务器守护程序不再拥有你撤回的GRANT特权。但是从理论上讲,这样的一个攻击可能给予BadGuy自由权力来实现他对你的数据库的任何操作。

  至于这样的一个多查询是否会被MySQL服务器处理,结论并不唯一。这其中的一些原因可能是由于不同版本的MySQL所致,但是大多数情况却是由于多查询存在的方式所致。MySQL的监视程序完全允许这样的一个查询。常用的MySQL GUI-phpMyAdmin,在最终查询之前会复制出以前所有的内容,并且仅仅这样做。

  但是,大多数的在一个注入上下文中的多查询都是由PHP的mysql扩展负责管理的。幸好,默认情况下,它是不允许在一个查询中执行多个指令的;试图执行两个指令(例如上面所示的注入)将会简单地导致失败-不设置任何错误,并且没有生成任何输出信息。在这种情况下,尽管PHP也只是"规规矩矩"地实现其缺省行为,但是确实能够保护你免于大多数简单的注入式攻击。

  PHP5中的新的mysqli扩展(参考http://php.net/mysqli),就象mysql一样,内在地也不支持多个查询,不过却提供了一个mysqli_multi_query()函数以支持你实现多查询-如果你确实想这样做的话。

  然而,对于SQLite-与PHP5绑定到一起的可嵌入的SQL数据库引擎(参考http://sqlite.org/和http://php.

bitsCN.com
Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
How to use MySQL functions for data processing and calculationHow to use MySQL functions for data processing and calculationApr 29, 2025 pm 04:21 PM

MySQL functions can be used for data processing and calculation. 1. Basic usage includes string processing, date calculation and mathematical operations. 2. Advanced usage involves combining multiple functions to implement complex operations. 3. Performance optimization requires avoiding the use of functions in the WHERE clause and using GROUPBY and temporary tables.

An efficient way to batch insert data in MySQLAn efficient way to batch insert data in MySQLApr 29, 2025 pm 04:18 PM

Efficient methods for batch inserting data in MySQL include: 1. Using INSERTINTO...VALUES syntax, 2. Using LOADDATAINFILE command, 3. Using transaction processing, 4. Adjust batch size, 5. Disable indexing, 6. Using INSERTIGNORE or INSERT...ONDUPLICATEKEYUPDATE, these methods can significantly improve database operation efficiency.

Steps to add and delete fields to MySQL tablesSteps to add and delete fields to MySQL tablesApr 29, 2025 pm 04:15 PM

In MySQL, add fields using ALTERTABLEtable_nameADDCOLUMNnew_columnVARCHAR(255)AFTERexisting_column, delete fields using ALTERTABLEtable_nameDROPCOLUMNcolumn_to_drop. When adding fields, you need to specify a location to optimize query performance and data structure; before deleting fields, you need to confirm that the operation is irreversible; modifying table structure using online DDL, backup data, test environment, and low-load time periods is performance optimization and best practice.

How to analyze the execution plan of MySQL queryHow to analyze the execution plan of MySQL queryApr 29, 2025 pm 04:12 PM

Use the EXPLAIN command to analyze the execution plan of MySQL queries. 1. The EXPLAIN command displays the execution plan of the query to help find performance bottlenecks. 2. The execution plan includes fields such as id, select_type, table, type, possible_keys, key, key_len, ref, rows and Extra. 3. According to the execution plan, you can optimize queries by adding indexes, avoiding full table scans, optimizing JOIN operations, and using overlay indexes.

How to use MySQL subquery to improve query efficiencyHow to use MySQL subquery to improve query efficiencyApr 29, 2025 pm 04:09 PM

Subqueries can improve the efficiency of MySQL query. 1) Subquery simplifies complex query logic, such as filtering data and calculating aggregated values. 2) MySQL optimizer may convert subqueries to JOIN operations to improve performance. 3) Using EXISTS instead of IN can avoid multiple rows returning errors. 4) Optimization strategies include avoiding related subqueries, using EXISTS, index optimization, and avoiding subquery nesting.

How to configure the character set and collation rules of MySQLHow to configure the character set and collation rules of MySQLApr 29, 2025 pm 04:06 PM

Methods for configuring character sets and collations in MySQL include: 1. Setting the character sets and collations at the server level: SETNAMES'utf8'; SETCHARACTERSETutf8; SETCOLLATION_CONNECTION='utf8_general_ci'; 2. Create a database that uses specific character sets and collations: CREATEDATABASEexample_dbCHARACTERSETutf8COLLATEutf8_general_ci; 3. Specify character sets and collations when creating a table: CREATETABLEexample_table(idINT

How to uninstall MySQL and clean residual filesHow to uninstall MySQL and clean residual filesApr 29, 2025 pm 04:03 PM

To safely and thoroughly uninstall MySQL and clean all residual files, follow the following steps: 1. Stop MySQL service; 2. Uninstall MySQL packages; 3. Clean configuration files and data directories; 4. Verify that the uninstallation is thorough.

How to rename a database in MySQLHow to rename a database in MySQLApr 29, 2025 pm 04:00 PM

Renaming a database in MySQL requires indirect methods. The steps are as follows: 1. Create a new database; 2. Use mysqldump to export the old database; 3. Import the data into the new database; 4. Delete the old database.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

SAP NetWeaver Server Adapter for Eclipse

SAP NetWeaver Server Adapter for Eclipse

Integrate Eclipse with SAP NetWeaver application server.

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Dreamweaver Mac version

Dreamweaver Mac version

Visual web development tools

EditPlus Chinese cracked version

EditPlus Chinese cracked version

Small size, syntax highlighting, does not support code prompt function