{"id":46,"date":"2016-07-27T22:03:57","date_gmt":"2016-07-27T14:03:57","guid":{"rendered":"http:\/\/www.91tfboys.com\/?p=46"},"modified":"2017-01-03T21:20:13","modified_gmt":"2017-01-03T13:20:13","slug":"dvwa-sql-injection%e6%89%8b%e5%b7%a5%e6%b3%a8%e5%85%a5","status":"publish","type":"post","link":"https:\/\/www.91tfboys.com\/?p=46","title":{"rendered":"DVWA SQL Injection\u624b\u5de5\u6ce8\u5165"},"content":{"rendered":"

SQL\u00a0Injection<\/span><\/h1>\n

\u5b9e\u9a8c\u62d3\u6251\u5982\u56fe6.0.1<\/span>\u3002<\/p>\n

\"tp\"<\/p>\n

\u56fe6.0.1\u00a0 <\/span>\u5b9e\u9a8c\u62d3\u6251<\/p>\n

6.1 Low<\/span>\u7ea7\u522b<\/h2>\n

<\/p>\n

\u9996\u5148\u8fde\u63a5\u6b64\u7ad9\u70b9\uff0c\u7f51\u7ad9\u6837\u5b50\u5982\u56fe6.1.1<\/span>\u6240\u793a\u3002<\/p>\n

\"6.1.1\"<\/p>\n

\u56fe6.1.1 SQL Injection<\/span>\u521d\u59cb\u754c\u9762<\/p>\n

\u6d4b\u8bd5\u4e00\u4e0b\uff0c\u5982\u56fe6.1.2<\/span>\u3002<\/p>\n

\"6.1.2\"<\/p>\n

\u56fe6.1.2 <\/span>\u5224\u65ad\u6ce8\u5165\u70b9<\/p>\n

\u968f\u540e\u5224\u65ad\u8868\u4e2d\u6709\u591a\u5c11\u5b57\u6bb5\uff0c\u4f7f\u7528\u547d\u4ee4
\n1′ order by 5#
\n<\/span>\u6765\u5224\u65ad\u3002\u5f53\u731c\u6d4b\u7684\u503c\u4e3a5<\/span>\u65f6\u7cfb\u7edf\u62a5\u9519\uff0c\u8bf4\u660e\u5b57\u6bb5\u503c\u5e94\u8be5\u5c0f\u4e8e5<\/span>\uff0c\u5982\u56fe6.1.3<\/span>\u6240\u793a\u3002<\/p>\n

\"6.1.3\"<\/p>\n

\u56fe6.1.3\u00a0 <\/span>\u5f53\u731c\u6d4b\u5b57\u6bb5\u503c\u4e3a5<\/span>\u65f6\u62a5\u9519<\/p>\n

\u7ecf\u8fc7\u8bd5\u9a8c\uff0c\u5f97\u5230\u6b63\u786e\u7684\u5b57\u6bb5\u503c\u4e3a2<\/span>\u3002<\/p>\n

\u63a5\u4e0b\u6765\u5224\u65ad\u7248\u672c\u548c\u6570\u636e\u5e93\u3002\u8f93\u5165
\n1′ and 1=2 union select user(),database() #
\n<\/span>\u5f97\u5230\u56fe6.1.4<\/span>\u7684\u7ed3\u679c\uff0c\u8bf4\u660e\u7528\u6237\u662froot<\/span>\uff0c\u6570\u636e\u5e93\u662fdvwa<\/span>\u3002\u7ee7\u7eed\u6d4b\u8bd5\uff0c\u8f93\u5165
\n1′ and 1=2 union select version(),database() #
\n<\/span>\u5f97\u5230\u56fe6.1.5<\/span>\u7684\u7ed3\u679c\uff0c\u8bf4\u660e\u7248\u672c\u662fMySql 5.0<\/span>\u3002<\/p>\n

\"6.1.4\"<\/p>\n

\u56fe6.1.4 \u00a0<\/span>\u5224\u65ad\u7528\u6237\u548c\u6570\u636e\u5e93<\/p>\n

\"6.1.5\"<\/p>\n

\u56fe6.1.5\u00a0 <\/span>\u5224\u65ad\u7248\u672c\u548c\u6570\u636e\u5e93<\/p>\n

\u63a5\u4e0b\u6765\u5224\u65ad\u8868\u3002\u8f93\u5165
\n1′ and 1=2 union select table_name,2 from information_schema.tables where
\ntable_schema=’dvwa’ #
\n<\/span>\u5224\u65ad\u5b58\u5728\u7684\u8868\uff0c\u8fd4\u56de\u7ed3\u679c\u5982\u56fe6.1.6<\/span>\uff0c\u53ef\u4ee5\u53d1\u73b0\u5b58\u5728guestbook<\/span>\u548cusers<\/span>\u8868\u3002<\/p>\n

\"6.1.6\"<\/p>\n

\u56fe6.1.6\u00a0 <\/span>\u5224\u65ad\u8868\u540d<\/p>\n

\u63a5\u4e0b\u6765\u5224\u65ad\u8868\u4e2d\u6709\u54ea\u4e9b\u5b57\u6bb5\uff0c\u4f7f\u7528users<\/span>\u8868\uff0c\u8f93\u5165\u547d\u4ee4
\n1′ and 1=2 union select column_name,2 from information_schema.columns where
\ntable_name=’users’ #
\n<\/span>\u5f97\u5230\u56fe6.1.7<\/span>\u7684\u7ed3\u679c\uff0c\u6240\u6709\u5b57\u6bb5\u5747\u663e\u793a\u51fa\u6765\u3002<\/p>\n

\"6.1.7\"<\/p>\n

\u56fe6.1.7\u00a0 <\/span>\u7206user<\/span>\u8868\u4e2d\u7684\u5b57\u6bb5<\/p>\n

\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\u5173\u952e\u5b57\u6bb5user<\/span>\u548cpassword<\/span>\uff0c\u76f4\u63a5\u4f7f\u7528
\n1′ and 1=2 union select user,password from users#
\n<\/span>\u547d\u4ee4\u83b7\u53d6\u6240\u6709\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u5982\u56fe6.1.8<\/span>\u3002<\/p>\n

\"6.1.8\"<\/p>\n

\u56fe6.1.8\u00a0 <\/span>\u7206\u7528\u6237\u540d\u548c\u5bc6\u7801<\/p>\n

\"6.1.9\"<\/p>\n

\u56fe6.1.9\u00a0 <\/span>\u7206guestbook<\/span>\u8868\u7684\u5b57\u6bb5<\/p>\n

\u6d4b\u8bd5\u53e6\u4e00\u5f20\u8868\uff0c\u53d1\u73b0\u5e76\u6ca1\u6709\u4ec0\u4e48\u6709\u7528\u7684\u4fe1\u606f\uff0c\u5982\u56fe6.1.9<\/span>\uff0c\u6545\u4e0d\u518d\u6df1\u6d4b\u3002<\/p>\n

\u00a0<\/span><\/p>\n

6.2 Medium<\/span>\u7ea7\u522b<\/h2>\n

\u8fd9\u4e2a\u7ea7\u522b\u91cc\uff0c\u7f51\u7ad9\u53ea\u5141\u8bb8\u4ece\u4e0b\u62c9\u5217\u8868\u4e2d\u9009\u53d6\u6570\u636e\uff0c\u4e14\u4f7f\u7528POST<\/span>\u65b9\u6cd5\u63d0\u4ea4\uff0c\u675c\u7edd\u4e86\u76f4\u63a5\u5728\u5730\u5740\u680f\u548cTextBox<\/span>\u4e2d\u5199\u5165\u6ce8\u5165\u8bed\u53e5\u7684\u53ef\u80fd\u3002\u9274\u4e8e\u6b64\uff0c\u6211\u4eec\u4f7f\u7528BurpSuite<\/span>\u6765\u4fee\u6539POST<\/span>\u63d0\u4ea4\u7684\u6570\u636e\uff0c\u5982\u56fe6.2.1<\/span>\u6240\u793a\u3002<\/p>\n

\"6.2.1\"<\/p>\n

\u56fe6.2.1\u00a0 <\/span>\u5728BurpSuite<\/span>\u4e2d\u4fee\u6539POST<\/span>\u63d0\u4ea4\u7684\u6570\u636e<\/p>\n

\"6.2.2\"<\/p>\n

\u56fe6.2.2\u00a0 <\/span>\u670d\u52a1\u5668\u5bf9\u201c\u2019<\/span>\u201d\u8fdb\u884c\u4e86\u8f6c\u4e49<\/p>\n

\u5728\u63d0\u4ea4\u6570\u636e\u4e4b\u540e\u5f97\u5230\u56fe6.2.2<\/span>\u7684\u7ed3\u679c\uff0c\u7531\u6b64\u7ed3\u679c\u53ef\u77e5\uff0c\u670d\u52a1\u7aef\u5bf9\u63d0\u4ea4\u7684\u6570\u636e\u8fdb\u884c\u4e86\u8fc7\u6ee4\uff0c\u5176\u4e2d\u201c\u2019<\/span>\u201d\u7b26\u53f7\u88ab\u8f6c\u4e49\u4e3a\u201c\\\u2019<\/span>\u201d\u3002\u5c06\u201c\u2019<\/span>\u201d\u7b26\u53f7\u53bb\u6389\uff0c\u76f4\u63a5\u4f7f\u75281 and 1=1<\/span>\u8bed\u53e5\u65f6\uff0c\u80fd\u5f97\u5230\u6b63\u5e38\u7ed3\u679c\uff0c\u5982\u56fe6.2.3<\/span>\u6240\u793a\uff0c\u5f53\u4f7f\u75281 and 1=2<\/span>\u65f6\u65e0\u7ed3\u679c\u3002\u7531\u6b64\u53ef\u4ee5\u5224\u65ad\u51fa\u53ea\u8981\u6211\u4eec\u4e0d\u4f7f\u7528\u201c\u2019<\/span>\u201d\u7b26\u53f7\uff0c\u4ecd\u7136\u5b58\u5728\u6210\u529f\u6ce8\u5165\u7684\u53ef\u80fd\u3002\u4e8e\u662f\u5728Low<\/span>\u7ea7\u522b\u7684\u57fa\u7840\u4e0a\uff0c\u76f4\u63a5\u4f7f\u75281 and 1=2 union select users,password
\nfrom users#<\/span>\u4fbf\u5f97\u5230\u4e86\u7ed3\u679c\uff0c\u5982\u56fe6.2.4<\/span>\u6240\u793a\u3002<\/p>\n

\"6.2.3\"<\/p>\n

\u56fe6.2.3 <\/span>\u53bb\u6389\u5355\u5f15\u53f7\u8fdb\u884c\u67e5\u8be2<\/p>\n

\"6.2.4\"<\/p>\n

\u56fe6.2.4\u00a0 <\/span>\u5f97\u5230\u7ed3\u679c<\/p>\n

\u00a0<\/span><\/p>\n

6.3 High<\/span>\u7ea7\u522b<\/h2>\n

\u5bf9\u4e8e\u9ad8\u7ea7\u522b\u7684\u96be\u5ea6\uff0c\u548b\u4e00\u770b\u633a\u9ad8\u5927\u4e0a\uff0c\u5982\u56fe6.3.1<\/span>\uff0c\u8fd8\u9700\u8981\u5f39\u7a97\u8f93\u5165ID<\/span>\u624d\u80fd\u67e5\u770b\u4fe1\u606f\u3002<\/p>\n

\"6.3.1\"<\/p>\n

\u56fe6.3.1\u00a0 <\/span>\u9ad8\u7ea7\u522b\u96be\u5ea6\u754c\u9762<\/p>\n

\u5c0f\u8bd5\u4e00\u4e0b\uff0c\u53d1\u73b0\u4ecd\u80fd\u8fdb\u884c\u6ce8\u5165\uff0c\u5982\u56fe6.3.2<\/span>\u3002<\/p>\n

\"6.3.2\"<\/p>\n

\u56fe6.3.2\u00a0 <\/span>\u9ad8\u7b49\u7ea7\u754c\u9762\u4ecd\u80fd\u8fdb\u884c\u6ce8\u5165<\/p>\n

\u6240\u4ee5\u76f4\u63a5\u4e0a\u5927\u62db\uff0c\u8bd5\u4e86\u4e00\u4e0bLevel Medium<\/span>\u91cc\u6700\u540e\u7684\u8bed\u53e5\uff0c\u5f97\u5230\u56fe6.3.3<\/span>\u3002\u7136\u800c\u8fd9\u5e76\u4e0d\u80fd\u5b9e\u73b0\u56fe6.2.4<\/span>\u7684\u6548\u679c\u3002\u8fd9\u65f6\u6ce8\u610f\u5230\u56fe6.3.2<\/span>\u4f7f\u7528\u4e86\u201c\u2019\u201d<\/span>\u7b26\u53f7\uff0c\u56e0\u6b64\u53ef\u4ee5\u5224\u65ad\u51fa\u8fd9\u6b21\u9700\u8981\u201c\u2019\u201d<\/span>\uff0c\u6545\u4f7f\u7528Level Low<\/span>\u91cc\u7684\u6700\u540e\u7684\u8bed\u53e5\uff0c\u6210\u529f\u83b7\u53d6\u5168\u90e8\u6570\u636e\uff0c\u5982\u56fe6.3.4<\/span>\u3002\u7531\u4e8e\u4e2d\u95f4\u8fc7\u7a0b\u548cLow<\/span>\u7ea7\u522b\u7c7b\u4f3c\uff0c\u6545\u4e0d\u518d\u7d2f\u8ff0\uff0c\u4e00\u4e9b\u4e0eLow<\/span>\u7ea7\u522b\u51fa\u5165\u7684\u5730\u65b9\uff0c\u57286.4<\/span>\u8282\u8fdb\u884c\u5206\u6790\u3002<\/p>\n

\"6.3.3\"<\/p>\n

\u56fe6.3.3 <\/span>\u4f7f\u7528Medium<\/span>\u7ea7\u522b\u7684\u8bed\u53e5\u6d4b\u8bd5<\/p>\n

\"6.3.4\"<\/p>\n

\u56fe6.3.4\u00a0 <\/span>\u83b7\u53d6\u5168\u90e8\u6570\u636e<\/p>\n

\u00a0<\/span><\/p>\n

6.4 <\/span>\u5206\u6790<\/h2>\n

\u56e0\u4e3aHigh<\/span>\u7ea7\u522b\u7684\u8fc7\u7a0b\u8fc7\u4e8e\u7b80\u5355\uff0c\u548c\u60f3\u60f3\u4e2d\u7684\u9ad8\u7ea7\u522b\u6709\u4e00\u5b9a\u7684\u533a\u522b\uff0c\u56e0\u6b64\u6211\u4eec\u6765\u5206\u6790\u4e00\u4e0b\u5404\u7ea7\u522b\u7684\u4ee3\u7801\u3002<\/p>\n

6.4.1 Low<\/span>\u7ea7\u522b<\/h3>\n

Low<\/span>\u7ea7\u522b\u7684\u4ee3\u7801\u5982\u4ee3\u7801\u6bb56.4.1<\/span>\u6240\u793a\u3002<\/p>\n

\u4ee3\u7801\u6bb56.4.1\u00a0 Low<\/span>\u7ea7\u522b\u4ee3\u7801<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

1<\/span><\/p>\n<\/td>\n

<\/td>\n\n

<?php<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

2<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

3<\/span><\/p>\n<\/td>\n

<\/td>\n\n

if(\u00a0isset(\u00a0<\/span>$_REQUEST<\/span>[\u00a0<\/span>‘Submit’\u00a0<\/span>]\u00a0)\u00a0)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

4<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0input<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

5<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>$id\u00a0<\/span>=\u00a0<\/span>$_REQUEST<\/span>[\u00a0<\/span>‘id’\u00a0<\/span>];<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

6<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

7<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Check\u00a0database<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

8<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>$query\u00a0\u00a0<\/span>=\u00a0<\/span>“SELECT\u00a0first_name,\u00a0last_name\u00a0FROM\u00a0users\u00a0WHERE\u00a0user_id\u00a0=\u00a0‘$id’;”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

9<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>$result\u00a0<\/span>=\u00a0<\/span>mysql_query<\/span>(\u00a0<\/span>$query\u00a0<\/span>)\u00a0or\u00a0die(\u00a0<\/span>‘<pre>’\u00a0<\/span>.\u00a0<\/span>mysql_error<\/span>()\u00a0.\u00a0<\/span>‘<\/pre>’\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

10<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

11<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0results<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

12<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>$num\u00a0<\/span>=\u00a0<\/span>mysql_numrows<\/span>(\u00a0<\/span>$result\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

13<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>$i\u00a0\u00a0\u00a0<\/span>=\u00a0<\/span>0<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

14<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0while(\u00a0<\/span>$i\u00a0<\/span><\u00a0<\/span>$num\u00a0<\/span>)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

15<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0values<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

16<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$first\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“first_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

17<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$last\u00a0\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“last_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

18<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

19<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Feedback\u00a0for\u00a0end\u00a0user<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

20<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>echo\u00a0<\/span>“<pre>ID:\u00a0{$id}<br\u00a0\/>First\u00a0name:\u00a0{$first}<br\u00a0\/>Surname:\u00a0{$last}<\/pre>”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

21<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

22<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Increase\u00a0loop\u00a0count<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

23<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$i<\/span>++;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

24<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

25<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

26<\/span><\/p>\n<\/td>\n

<\/td>\n\n

\u00a0\u00a0\u00a0\u00a0<\/span>mysql_close<\/span>();<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

27<\/span><\/p>\n<\/td>\n

<\/td>\n\n

}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

28<\/span><\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

29<\/span><\/p>\n<\/td>\n

<\/td>\n\n

?> <\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u7531\u6b64\u4ee3\u7801\u53ef\u77e5\uff0c\u8fd9\u91cc\u5bf9\u8f93\u5165\u7684\u5185\u5bb9\u6ca1\u6709\u8fdb\u884c\u4efb\u4f55\u8fc7\u6ee4\u7b49\u64cd\u4f5c\uff0c\u76f4\u63a5\u5bf9\u8f93\u5165\u7684\u503c\u8fdb\u884c\u6784\u9020SQL<\/span>\u8bed\u53e5\uff0c\u5e76\u4f7f\u7528\u4e4b\u8fdb\u884c\u67e5\u8be2\uff08\u7b2c5<\/span>\u884c\u5230\u7b2c9<\/span>\u884c\uff09\u3002\u4f8b\u5982\uff0c\u5f53\u6211\u4eec\u6267\u884c1′ and exists(select * from admin)#<\/span>\u65f6\uff0cid<\/span>\u7684\u503c\u5373\u4e3a1′ and exists(select * from admin)#<\/span>\uff0c\u7531\u6b64\u6784\u9020\u7684SQL<\/span>\u8bed\u53e5query<\/span>\u4e3aSELECT first_name, last_name FROM
\nusers WHERE user_id = ‘1’ and exists(select * from admin)#’;<\/span>\u3002\u8fd9\u65f6\u6211\u4eec\u53ef\u4ee5\u770b\u5230\uff0c\u539f\u672c\u7684\u83b7\u53d6id<\/span>\u7684\u8bed\u53e5\u53d8\u6210\u4e86\u83b7\u53d6id<\/span>\u5e76\u5224\u65ad\u662f\u5426\u5b58\u5728admin<\/span>\u8868\uff0c\u4e2d\u95f4\u662fand<\/span>\u8fde\u63a5\uff0c\u5373\u53ea\u6709\u4e24\u4e2a\u90fd\u4e3a\u771f\u624d\u8fd4\u56de\u771f\u3002\u800c\u6700\u540e\u7684\u201c#<\/span>\u201d\u7b26\u53f7\u53c8\u5bf9\u5269\u4e0b\u7684\u8bed\u53e5\u8fdb\u884c\u4e86\u6ce8\u91ca\uff0c\u786e\u4fdd\u53ea\u6267\u884c\u6211\u4eec\u60f3\u8981\u7684\u90e8\u5206\u3002\u8fd9\u4e00\u70b9\u5728\u63a5\u4e0b\u6765\u7684\u64cd\u4f5c\u91cc\u975e\u5e38\u91cd\u8981\u3002\u6240\u4ee5\u540e\u6765\u6211\u4eec\u5c31\u53ef\u4ee5\u6839\u636e\u8fd9\u4e2a\u539f\u7406\u8fdb\u884c\u8bed\u53e5\u6784\u9020\uff0c\u731c\u6d4b\u8868\u7ed3\u6784\uff0c\u83b7\u53d6\u6211\u4eec\u60f3\u8981\u7684\u5404\u79cd\u4fe1\u606f\u3002<\/p>\n

\u00a0<\/span><\/p>\n

6.4.2 Medium<\/span>\u7ea7\u522b<\/h3>\n

Medium<\/span>\u7ea7\u522b\u7684\u4ee3\u7801\u5982\u4ee3\u7801\u6bb56.4.2<\/span>\u3002<\/p>\n

\u4ee3\u7801\u6bb56.4.2\u00a0 Medium<\/span>\u7ea7\u522b\u4ee3\u7801<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

1<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

<?php<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

2<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

3<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

if(\u00a0isset(\u00a0<\/span>$_POST<\/span>[\u00a0<\/span>‘Submit’\u00a0<\/span>]\u00a0)\u00a0)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

4<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0input<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

5<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$id\u00a0<\/span>=\u00a0<\/span>$_POST<\/span>[\u00a0<\/span>‘id’\u00a0<\/span>];<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

6<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$id\u00a0<\/span>=\u00a0<\/span>mysql_real_escape_string<\/span>(\u00a0<\/span>$id\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

7<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

8<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Check\u00a0database<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

9<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$query\u00a0\u00a0<\/span>=\u00a0<\/span>“SELECT\u00a0first_name,\u00a0last_name\u00a0FROM\u00a0users\u00a0WHERE\u00a0user_id\u00a0=\u00a0$id;”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

10<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$result\u00a0<\/span>=\u00a0<\/span>mysql_query<\/span>(\u00a0<\/span>$query\u00a0<\/span>)\u00a0or\u00a0die(\u00a0<\/span>‘<pre>’\u00a0<\/span>.\u00a0<\/span>mysql_error<\/span>()\u00a0.\u00a0<\/span>‘<\/pre>’\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

11<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

12<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0results<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

13<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$num\u00a0<\/span>=\u00a0<\/span>mysql_numrows<\/span>(\u00a0<\/span>$result\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

14<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$i\u00a0\u00a0\u00a0<\/span>=\u00a0<\/span>0<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

15<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0while(\u00a0<\/span>$i\u00a0<\/span><\u00a0<\/span>$num\u00a0<\/span>)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

16<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Display\u00a0values<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

17<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$first\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“first_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

18<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$last\u00a0\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“last_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

19<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

20<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Feedback\u00a0for\u00a0end\u00a0user<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

21<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>echo\u00a0<\/span>“<pre>ID:\u00a0{$id}<br\u00a0\/>First\u00a0name:\u00a0{$first}<br\u00a0\/>Surname:\u00a0{$last}<\/pre>”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

22<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

23<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Increase\u00a0loop\u00a0count<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

24<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$i<\/span>++;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

25<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

26<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

27<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/mysql_close();<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

28<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

29<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

30<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

?> <\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u7531\u6b64\u4ee3\u7801\u7b2c6<\/span>\u884c\u53ef\u77e5\uff0c\u8fd9\u91cc\u4f7f\u7528\u4e86 mysql_real_escape_string() <\/span>\u51fd\u6570\u5bf9\u8f93\u5165\u7684\u5b57\u7b26\u4e32\u8fdb\u884c\u7b80\u5355\u7684\u8fc7\u6ee4\uff0c\u5c06\u4e00\u4e9b\u5b57\u7b26\u8fdb\u884c\u8f6c\u4e49\uff0c\u5982\u201c\u2019<\/span>\u201d\u3001\u201c\u201d<\/span>\u201d\u7b49\uff0c\u5e76\u8fd4\u56de\u8f6c\u4e49\u540e\u7684\u5b57\u7b26\u4e32\u3002\u7136\u800c\u7531\u7b2c9<\/span>\u884c\u7684\u4ee3\u7801\u53ef\u77e5\uff0c\u8fd9\u91cc\u5728\u8fdb\u884c\u67e5\u8be2\u65f6\u5e76\u6ca1\u6709\u5bf9\u8f6c\u4e49\u540e\u7684\u7ed3\u679c\u52a0\u4e0a\u5355\u5f15\u53f7\uff0c\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u4e0d\u4f7f\u7528\u5f15\u53f7\u8fdb\u884c\u6ce8\u5165\u3002\u7531\u6b64\u4fbf\u5f97\u5230\u4e866.2<\/span>\u8282\u91cc\u7684\u5185\u5bb9\u3002<\/p>\n

\u5982\u679c\u4e0d\u5728Low<\/span>\u7ea7\u522b\u7684\u57fa\u7840\u4e0a\u8fdb\u884c\u64cd\u4f5c\uff0c\u5219\u57fa\u672c\u8fc7\u7a0b\u4e5f\u548cLow<\/span>\u7ea7\u522b\u4e00\u6837\uff0c\u53ea\u4e0d\u8fc7\u53d8\u6210\u4e86\u5728BurpSuite<\/span>\u4e2d\u4fee\u6539POST<\/span>\u7684\u6570\u636e\uff0c\u518d\u8fdb\u884c\u8f6c\u53d1\u3002<\/p>\n

\u00a0<\/span><\/p>\n

6.4.3 High<\/span>\u7ea7\u522b<\/h3>\n

\u518d\u6765\u770bHigh<\/span>\u7ea7\u522b\u7684\u5185\u5bb9\uff0c\u4ee3\u7801\u5982\u4ee3\u7801\u6bb56.4.3<\/span>\u6240\u793a\u3002<\/p>\n

\u4ee3\u7801\u6bb56.4.3\u00a0 High<\/span>\u7ea7\u522b\u4ee3\u7801<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

1<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

<?php<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

2<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

3<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

if(\u00a0isset(\u00a0<\/span>$_SESSION\u00a0<\/span>[\u00a0<\/span>‘id’\u00a0<\/span>]\u00a0)\u00a0)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

4<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0input<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

5<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$id\u00a0<\/span>=\u00a0<\/span>$_SESSION<\/span>[\u00a0<\/span>‘id’\u00a0<\/span>];<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

6<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

7<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Check\u00a0database<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

8<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$query\u00a0\u00a0<\/span>=\u00a0<\/span>“SELECT\u00a0first_name,\u00a0last_name\u00a0FROM\u00a0users\u00a0WHERE\u00a0user_id\u00a0=\u00a0‘$id’\u00a0LIMIT\u00a01;”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

9<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$result\u00a0<\/span>=\u00a0<\/span>mysql_query<\/span>(\u00a0<\/span>$query\u00a0<\/span>)\u00a0or\u00a0die(\u00a0<\/span>‘<pre>Something\u00a0went\u00a0wrong.<\/pre>’\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

10<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

11<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0results<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

12<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$num\u00a0<\/span>=\u00a0<\/span>mysql_numrows<\/span>(\u00a0<\/span>$result\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

13<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>$i\u00a0\u00a0\u00a0<\/span>=\u00a0<\/span>0<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

14<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0while(\u00a0<\/span>$i\u00a0<\/span><\u00a0<\/span>$num\u00a0<\/span>)\u00a0{<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

15<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Get\u00a0values<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

16<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$first\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“first_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

17<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$last\u00a0\u00a0<\/span>=\u00a0<\/span>mysql_result<\/span>(\u00a0<\/span>$result<\/span>,\u00a0<\/span>$i<\/span>,\u00a0<\/span>“last_name”\u00a0<\/span>);<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

18<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

19<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Feedback\u00a0for\u00a0end\u00a0user<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

20<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>echo\u00a0<\/span>“<pre>ID:\u00a0{$id}<br\u00a0\/>First\u00a0name:\u00a0{$first}<br\u00a0\/>Surname:\u00a0{$last}<\/pre>”<\/span>;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

21<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

22<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\/\/\u00a0Increase\u00a0loop\u00a0count<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

23<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$i<\/span>++;<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

24<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

25<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

26<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0\u00a0\u00a0\u00a0<\/span>mysql_close<\/span>();<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

27<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

}<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

28<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

29<\/span><\/p>\n<\/td>\n

\n

\u00a0<\/span><\/p>\n<\/td>\n

\n

?> <\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u7531\u7b2c3<\/span>\u884c\u3001\u7b2c5<\/span>\u884c\u53ef\u77e5\uff0c\u8fd9\u91cc\u4f7f\u7528SESSION<\/span>\u65b9\u6cd5\u6765\u4f20\u9012id<\/span>\u7684\u503c\uff0c\u5728\u7b2c9<\/span>\u884c\u4f7f\u7528mysql_query()<\/span>\u548cdie()<\/span>\u51fd\u6570\uff0c\u4f7f\u5f97\u5f53\u67e5\u8be2\u4e0d\u6210\u529f\u65f6\u6574\u4e2a\u9875\u9762\u76f4\u63a5down<\/span>\u6389\uff0c\u5982\u56fe6.4.1<\/span>\uff0c\u9000\u51fa\u91cd\u65b0\u767b\u5f55\u4e5f\u6ca1\u7528\uff0c\u9664\u975e\u9000\u51fa\u5e76\u628acookie<\/span>\u6e05\u7a7a\uff0c\u518d\u5237\u65b0\u767b\u5f55\u3002<\/p>\n

\"6.4.1\"<\/p>\n

\u56fe6.4.1\u00a0 die<\/span>\u6389\u7684\u9875\u9762<\/p>\n

\u89c2\u5bdfquery<\/span>\u8bed\u53e5\u6784\u9020\u4ee3\u7801\uff08\u7b2c8<\/span>\u884c\uff09\u53ef\u77e5\uff0c\u8fd9\u91cc\u7684\u67e5\u8be2\u8bed\u53e5\u548c\u4ee5\u5f80\u7684\u4e0d\u540c\uff0c\u8fd9\u91cc\u6dfb\u52a0\u4e86LIMIT 1<\/span>\u7684\u9650\u5236\uff0c\u53ea\u8fd4\u56de\u7b2c\u4e00\u5217\u7684\u5185\u5bb9\u3002\u7136\u800c\u6211\u4eec\u4f7f\u7528\u201c#<\/span>\u201d\u76f4\u63a5\u628a\u8fd9\u53e5\u6ce8\u91ca\u6389\u4e86\uff0c\u6240\u4ee5\u8fd9\u4e2a\u9650\u5236\u5e76\u4e0d\u662f\u5f88\u5927\uff0c\u6211\u4eec\u4f9d\u7136\u53ef\u4ee5\u62ff\u5230\u60f3\u8981\u7684\u6570\u636e\u3002<\/p>\n

\u8fd9\u91cc\u7531\u4e8e\u4e09\u4e2a\u7b49\u7ea7\u5728\u4e00\u8d77\u5b9e\u9a8c\uff0c\u6240\u4ee5\u501f\u9274\u4e86\u524d\u4e24\u4e2a\u7b49\u7ea7\u7684\u4ee3\u7801\uff0c\u800c\u5982\u679c\u771f\u6b63\u8981\u4ece0<\/span>\u5f00\u59cb\u7684\u8bdd\u80af\u5b9a\u8981\u6709\u4e00\u4e9b\u67e5\u8be2\u5931\u8d25\u7684\u5730\u65b9\uff0c\u8fd9\u65f6\u5c31\u4f1a\u4e0d\u65ad\u51fa\u73b0\u56fe6.4.1<\/span>\u7684\u73b0\u8c61\uff0c\u9700\u8981\u4e0d\u505c\u5730\u6e05\u9664cookie<\/span>\u624d\u80fd\u6210\u529f\u3002\u4f46\u57fa\u672c\u601d\u8def\u548c\u539f\u7406\u7c7b\u4f3c\u3002<\/p>\n

\u539f\u521b\u6587\u7ae0\uff0c91tfboys.com\u7248\u6743\u6240\u6709\uff0c\u8f6c\u8f7d\u8bf7\u6ce8\u660e\u51fa\u5904\u3002<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

SQL\u00a0Injection \u5b9e\u9a8c\u62d3\u6251\u5982\u56fe6.0.1\u3002 \u56fe6.0.1\u00a0 \u5b9e\u9a8c\u62d3\u6251 6.1 Low\u7ea7\u522b<\/p>\n","protected":false},"author":1,"featured_media":238,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-46","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-coding"],"_links":{"self":[{"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/posts\/46","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=46"}],"version-history":[{"count":7,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/posts\/46\/revisions"}],"predecessor-version":[{"id":153,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/posts\/46\/revisions\/153"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=\/wp\/v2\/media\/238"}],"wp:attachment":[{"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=46"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=46"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.91tfboys.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=46"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}