mysql - 看这条sql有可能被注入吗

Question

SELECT * FROM table1 where condition1=1 ORDER BY $sortField$ $sortOrder$ limit 0,20

$sortField$和$sortOrder$可以写任意sql

这条sql有被注入的风险吗

Answer 1

As long as you directly use variables to generate sql statements, there is a risk of being injected

SELECT * FROM table1 where condition1=1 ORDER BY $sortField$ $sortOrder$ limit 0,20

sortField="id"
sortOrder="; drop table users; --"

Your sql will become

SELECT * FROM table1 where condition1=1 ORDER BY id; drop table users; -- limit 0,20

Answer 2

You are thinking about the problem in the wrong direction.

The correct way to prevent injection is to use the parameter mode of the official driver, because only the official version knows how to avoid being injected.

If you write SQL yourself, even if it is not injected now, maybe if one of the components involved in this link changes in the future, there will be a risk of being injected.

Answer 3

You can directly test it with sqlmap, its engine is still very powerful