String ('A=0) is appended to the HTTP GET URL

时间:2016-12-02 05:16:33

标签: php mysql web

Some of our users had some intermittent error on our website (PDOexception). Upon checking the log, I found that the string String ('A=0) are appended to the HTTP get. This is weird, because we definitely did not code this and it only happens to certain users in different pages and also not consistently.

Error log below: [error] 28960#0: *500749 FastCGI sent in stderr: "PHP message: An Error occurred while handling another error: exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'A=0' LIMIT 1' at line 4'

while reading response header from upstream, client: 10.202.1.135, server: xxxx.com, request: "GET /index.php/productdetail?pid=8473'A=0 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "xxxx.com"

Note: /index.php/productdetail?pid=8473 is correct URL without the 'A=0

Thanks for anyone who can give some insight on how/when the 'A=0 are appended.

1 个答案:

答案 0 :(得分:1)

这不是你的代码。它来自SQL注入探测器。更多细节可以在这里找到:

Strange URL containing 'A=0 or '0=A in web server logs

在上周,我在不同的网页和不同的IP上看到了150个这样的请求。您可以通过检查UserAgent是否与该帖子中的那个匹配来确认:

Mozilla / 5.0(Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2)Gecko / 20090729 Firefox / 3.5.2(.NET CLR 3.5.30729)