bitsCN.com
net/sqlite)情况更为可怕,由于其易于使用而吸引了大量用户的关注。在有些情况下,SQLite缺省地允许这样的多指令查询,因为该数据库可以优化批查询,特别是非常有效的批INSERT语句处理。然而,如果查询的结果为你的脚本所使用的话(例如在使用一个SELECT语句检索记录的情况下),sqlite_query()函数却不会允许执行多个查询。
三、 INVISION Power BOARD SQL注入脆弱性
Invision Power Board是一个著名的论坛系统。2005年五月6号,在登录代码中发现了一处SQL注入脆弱性。其发现者为GulfTech Security Research的James Bercegay。
这个登录查询如下所示:
$DB->query("SELECT * FROM ibf_members WHERE id=$mid AND password='$pid'");
其中,成员ID变量$mid和口令ID变量$pid被使用下面两行代码从my_cookie()函数中检索出:
$mid = intval($std->my_getcookie('member_id'));
$pid = $std->my_getcookie('pass_hash');
在此,my_cookie()函数使用下列语句从cookie中检索要求的变量:
return urldecode($_COOKIE[$ibforums->vars['cookie_id'].$name]);
【注意】从该cookie返回的值根本没有被处理。尽管$mid在使用于查询之前被强制转换成一个整数,但是$pid却保持不变。因此,它很容易遭受我们前面所讨论的注入类型的攻击。
因此,通过以如下方式修改my_cookie()函数,这种脆弱性就会暴露出来:
if ( ! in_array( $name,array('topicsread', 'forum_read','collapseprefs') ) )
{
return $this->
clean_value(urldecode($_COOKIE[$ibforums->vars['cookie_id'].$name]));
}
else
{
return urldecode($_COOKIE[$ibforums->vars['cookie_id'].$name]);
}
经过这样的改正之后,其中的关键变量在"通过"全局clean_value()函数后被返回,而其它变量却未进行检查。
现在,既然我们大致了解了什么是SQL注入,它的注入原理以及这种注入的脆弱程度,那么接下来,让我们探讨如何有效地预防它。幸好,PHP为我们提供了丰富的资源,因此我们有充分的信心预言,一个经仔细地彻底地使用我们所推荐的技术构建的应用程序将会从你的脚本中根本上消除任何可能性的SQL注入-通过在它可能造成任何损坏之前"清理"你的用户的数据来实现。
四、 界定你的查询中的每一个值
我们推荐,你确保界定了你的查询中的每一个值。字符串值首当其冲,以及那些你通常期望应该使用"单"(而不是"双")引号的内容。一方面,如果你使用双引号来允许PHP在字符串内的变量替代,这样可以使得输入查询更为容易些;另一方面,这(无可否认,只是极少量地)也会减少以后PHP代码的分析工作。
下面,让我们使用我们一开始使用的那个非注入式查询来说明这个问题:
SELECT * FROM wines WHERE variety = 'lagrein'
或以PHP语句表达为:
$query = "SELECT * FROM wines WHERE variety = '$variety'";
从技术上讲,引号对于数字值来说是不需要使用的。但是,如果你并不介意用引号把例如葡萄酒这样的一个域相应的一个值括起来并且如果你的用户把一个空值输入到你的表单中的话,那么,你会看到一个类似下面的查询:
SELECT * FROM wines WHERE vintage =
当然,这个查询从语法上讲是无效的;但是,下面的语法却是有效的:
SELECT * FROM wines WHERE vintage = ''
第二个查询将(大概)不会返回任何果,但是至少它不会返回一个错误消息。
五、 检查用户提交的值的类型
从前面的讨论中我们看到,迄今为止,SQL注入的主要来源往往出在一个意料之外的表单入口上。然而,当你经由一个表单向用户提供机会提交某些值时,你应该有相当的优势来确定你想取得什么样的输入内容-这可以使得我们比较容易地检查用户入口的有效性。在以前的文章中,我们已经讨论过这样的校验问题;所以,在此,我们仅简单地总结当时我们讨论的要点。如果你正在期望一个数字,那么你可以使用下面这些技术之一来确保你得到的真正是一个数字类型:
bitsCN.com
InnoDBBufferPool reduces disk I/O by caching data and indexing pages, improving database performance. Its working principle includes: 1. Data reading: Read data from BufferPool; 2. Data writing: After modifying the data, write to BufferPool and refresh it to disk regularly; 3. Cache management: Use the LRU algorithm to manage cache pages; 4. Reading mechanism: Load adjacent data pages in advance. By sizing the BufferPool and using multiple instances, database performance can be optimized.

Compared with other programming languages, MySQL is mainly used to store and manage data, while other languages such as Python, Java, and C are used for logical processing and application development. MySQL is known for its high performance, scalability and cross-platform support, suitable for data management needs, while other languages have advantages in their respective fields such as data analytics, enterprise applications, and system programming.

MySQL is worth learning because it is a powerful open source database management system suitable for data storage, management and analysis. 1) MySQL is a relational database that uses SQL to operate data and is suitable for structured data management. 2) The SQL language is the key to interacting with MySQL and supports CRUD operations. 3) The working principle of MySQL includes client/server architecture, storage engine and query optimizer. 4) Basic usage includes creating databases and tables, and advanced usage involves joining tables using JOIN. 5) Common errors include syntax errors and permission issues, and debugging skills include checking syntax and using EXPLAIN commands. 6) Performance optimization involves the use of indexes, optimization of SQL statements and regular maintenance of databases.

MySQL is suitable for beginners to learn database skills. 1. Install MySQL server and client tools. 2. Understand basic SQL queries, such as SELECT. 3. Master data operations: create tables, insert, update, and delete data. 4. Learn advanced skills: subquery and window functions. 5. Debugging and optimization: Check syntax, use indexes, avoid SELECT*, and use LIMIT.

MySQL efficiently manages structured data through table structure and SQL query, and implements inter-table relationships through foreign keys. 1. Define the data format and type when creating a table. 2. Use foreign keys to establish relationships between tables. 3. Improve performance through indexing and query optimization. 4. Regularly backup and monitor databases to ensure data security and performance optimization.

MySQL is an open source relational database management system that is widely used in Web development. Its key features include: 1. Supports multiple storage engines, such as InnoDB and MyISAM, suitable for different scenarios; 2. Provides master-slave replication functions to facilitate load balancing and data backup; 3. Improve query efficiency through query optimization and index use.

SQL is used to interact with MySQL database to realize data addition, deletion, modification, inspection and database design. 1) SQL performs data operations through SELECT, INSERT, UPDATE, DELETE statements; 2) Use CREATE, ALTER, DROP statements for database design and management; 3) Complex queries and data analysis are implemented through SQL to improve business decision-making efficiency.

The basic operations of MySQL include creating databases, tables, and using SQL to perform CRUD operations on data. 1. Create a database: CREATEDATABASEmy_first_db; 2. Create a table: CREATETABLEbooks(idINTAUTO_INCREMENTPRIMARYKEY, titleVARCHAR(100)NOTNULL, authorVARCHAR(100)NOTNULL, published_yearINT); 3. Insert data: INSERTINTObooks(title, author, published_year)VA


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

MantisBT
Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

WebStorm Mac version
Useful JavaScript development tools

ZendStudio 13.5.1 Mac
Powerful PHP integrated development environment

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

Notepad++7.3.1
Easy-to-use and free code editor