php - 破解登录密码测试

Question

<分区>

Answer 1

您给出的示例利用了经过深思熟虑的代码，其中用户输入未被转义并用于查询。 假设有一个带有用户和密码字段的表单 (form.html)，它将输入的值传递给 php 脚本 (test.php)。假设用户在两个字段中写入 '' OR 1 =1--

下面的代码不会转义用户输入。您应该使用 mysql_real_escape_string() 或参数化查询来执行此操作。

表单.html:

<form method="POST" action="test.php">
    <input type="text" name="login" value=""><br />
    <input type="text" name="password" value=""><br />
    <input type="submit"/>
</form>    

测试.php:

$name = $_POST['login'];
$pass = $_POST['password'];
echo $name . "<br />";
$sql= "SELECT * FROM users WHERE login = $name AND password = $pass ";
// $sql now contains this command:
// SELECT * FROM users WHERE login= '' OR 1=1-- AND password = '' OR 1 =1-- 
// condition OR 1=1 means that any row satisfies the query
// as long as there is at least 1 row in the table users, authorisation will be succcesful
echo $sql . "<br />";
$result=mysql_query($sql);