手把手叫你SQL注入攻防(PHP語法)
1.什么是SQL注入,猛戳wikipedia查看
2.本地測試代碼:
如果表單提交正確,就打印hello,“username”
否則,打印“404 not found!”
<?php require 'config.php'; $DBConnection = mysql_connect ( "$dbhost", "$dbuser", "$dbpwd" ); mysql_select_db ( "$dbdatabase" ); if(isset($_GET['submit']) && $_GET['submit']){ $sql="select * from test where name='".$_GET['username']."'and password='".$_GET['password']."'"; //echo $sql;exit; $result=mysql_query($sql,$DBConnection); $num=mysql_num_rows($result); if($num>=1) { echo "hello,".$_GET['username']; } else { echo"404 not found"; } } ?> <form action="login.php" method="GET"> <table> <tr> <td>username</td> <td><input type="textbox" name="username"/></td> <td>password</td> <td><input type="textbox" name="password"></td> <td>submit</td> <td><input type="submit" name="submit"></td> </tr> </table> </form> |
3.瀏覽器界面顯示:
4.重頭戲,sql注入:
posted on 2014-01-29 10:49 順其自然EVO 閱讀(321) 評論(0) 編輯 收藏 所屬分類: 數(shù)據(jù)庫