Question

我必须创建一个可以注入SQL的应用程序，但我无法使SQL注入成为可能。我尝试了所有SQL注入它，但我没有成功。可以编写像admin'#这样的用户名，因为它会注释掉该行。

我希望你能帮助我。你看到我的代码就在下面。

<?php
    include('include/config.php');
    include('parts/header.php');

    $submit = $_POST['submit'];
    $username = $_POST['username'];
    $password = $_POST['password'];

    if ($submit) {
        if(!empty($username OR !empty($password))) {
            $sqlQuery = mysql_query("SELECT * FROM users WHERE username = '$username' AND password = '$password'");

            if(mysql_num_rows($sqlQuery) == 1) {
                // Success - admin'#
                echo "LOGGEDIN";
                $_SESSION['loggedin'] = 1;
            }
            else {
                echo "Wrong password or username";
            }
        }
        else {
            echo "You didn't fill every field.";
        }
    }
?>

<div id="container">
    <form action="login.php" method="POST">
        <input type="text" name="username" placeholder="Type user name...">
        <input type="password" name="password" placeholder="Type password...">
        <input type="submit" name="submit" value="Log in">
    </form>
</div>

Answer 1

{{1}}

您的查询输出将是这个并且始终为true，

{{1}}

Answer 2

您可以使用mysql_real_escape_string函数使变量安全：

$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);

为什么不能将SQL注入？

2 个答案: