php - 代码点火器 SQL 注入(inject)

Question

我的 Controller 上有这段代码:

$sql = "SELECT * FROM user WHERE id = " . $this->input->get('foo'); 
$foo = $this->db->query($sql);
echo '<pre>';
print_r($foo->result());
echo '</pre>';
die();

我注意到如果我使用这个 URL:
www.site.com?foo=1 或 1 = 1
显示用户表的所有数据:

Array
(
[0] => stdClass Object
    (
        [id] => 1
        [email] => aaa@gmail.com
        [password] => aaa
    )
[1] => stdClass Object
    (
        [id] => 1
        [email] => bbb@gmail.com
        [password] => bbb
    )
[2] => stdClass Object
    (
        [id] => 1
        [email] => ccc@gmail.com
        [password] => ccc
    )
)

是否可以运行另一个从 user_phone 表返回数据的查询？

表格:

CREATE TABLE `user` (
  `id` INT(11) UNSIGNED NOT NULL AUTO_INCREMENT,
  `email` VARCHAR(100) NOT NULL,
  `password` VARCHAR(255) NOT NULL
  PRIMARY KEY (`id`),
) ENGINE=INNODB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8


CREATE TABLE `user_phone` (
  `id` INT(11) UNSIGNED NOT NULL AUTO_INCREMENT,
  `id_user` INT(11) UNSIGNED NOT NULL,
  `number` INT(11) UNSIGNED NOT NULL
  PRIMARY KEY (`id`)
) ENGINE=INNODB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8

数据:

INSERT  INTO `user`(`email`,`password`) VALUES ('aaa@gmail.com','aaa');
INSERT  INTO `user`(`email`,`password`) VALUES ('bbb@gmail.com','bbb');
INSERT  INTO `user`(`email`,`password`) VALUES ('ccc@gmail.com','ccc');

INSERT  INTO `user_phone`(`id_user`,`number`) VALUES ('1','911911911');
INSERT  INTO `user_phone`(`id_user`,`number`) VALUES ('1','922922922');
INSERT  INTO `user_phone`(`id_user`,`number`) VALUES ('2','955955955');
INSERT  INTO `user_phone`(`id_user`,`number`) VALUES ('3','711711711');

谢谢

编辑:
我知道防止这种情况发生的现有机制。
我的问题是是否可能以及如何从其他表中获取数据。

Answer 1

我认为它会是这样的。

www.site.com?foo=1 OR 1 = 1 union select * from user_phone where user_phone.id_user = user.id