皮卡丘靶場 防止 字元型注入 加固
阿新 • • 發佈：2022-04-18
這是未加固前的程式碼
1 <?php 2 /** 3 * Created by runner.han 4 * There is nothing new under the sun 5 */ 6 7 8 $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); 9 10 if ($SELF_PAGE = "sqli_str.php"){ 11 $ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','');12 } 13 14 $PIKA_ROOT_DIR = "../../"; 15 include_once $PIKA_ROOT_DIR . 'header.php'; 16 17 include_once $PIKA_ROOT_DIR."inc/config.inc.php"; 18 include_once $PIKA_ROOT_DIR."inc/function.php"; 19 include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; 20 21 $link=connect(); 22 $html=''; 23 24 if(isset($_GET['submit']) && $_GET['name']!=null){ 25 //這裡沒有做任何處理，直接拼到select裡面去了 26 $name=$_GET['name']; 27 //這裡的變數是字元型，需要考慮閉合 28 $query="select id,email from member where username='$name'"; 29 $result=execute($link, $query); 30 if(mysqli_num_rows($result)>=1){ 31 while($data=mysqli_fetch_assoc($result)){32 $id=$data['id']; 33 $email=$data['email']; 34 $html.="<p class='notice'>your uid:{$id} <br />your email is: {$email}</p>"; 35 } 36 }else{ 37 38 $html.="<p class='notice'>您輸入的username不存在，請重新輸入！</p>"; 39 } 40 } 41 42 43 44 ?> 45 46 47 <div class="main-content"> 48 <div class="main-content-inner"> 49 <div class="breadcrumbs ace-save-state" id="breadcrumbs"> 50 <ul class="breadcrumb"> 51 <li> 52 <i class="ace-icon fa fa-home home-icon"></i> 53 <a href="sqli.php">sqli</a> 54 </li> 55 <li class="active">字元型注入</li> 56 </ul><!-- /.breadcrumb --> 57 58 <a href="#" style="float:right" data-container="body" data-toggle="popover" data-placement="bottom" title="tips(再點一下關閉)" 59 data-content="變數型別為字元型"> 60 點一下提示~ 61 </a> 62 63 </div> 64 <div class="page-content"> 65 66 67 <div id="sqli_main"> 68 <p class="sqli_title">what's your username?</p> 69 <form method="get"> 70 <input class="sqli_in" type="text" name="name" /> 71 <input class="sqli_submit" type="submit" name="submit" value="查詢" /> 72 </form> 73 <?php echo $html;?> 74 </div> 75 76 77 78 79 </div><!-- /.page-content --> 80 </div> 81 </div><!-- /.main-content --> 82 83 84 85 86 87 <?php 88 include_once $PIKA_ROOT_DIR . 'footer.php'; 89 90 ?>
首先看看沒有加固前的效果
' or '1'='1' --+
下面進行加固
1 <?php 2 /** 3 * Created by runner.han 4 * There is nothing new under the sun 5 */ 6 7 8 $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); 9 10 if ($SELF_PAGE = "sqli_str.php"){ 11 $ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); 12 } 13 14 $PIKA_ROOT_DIR = "../../"; 15 include_once $PIKA_ROOT_DIR . 'header.php'; 16 17 include_once $PIKA_ROOT_DIR."inc/config.inc.php"; 18 include_once $PIKA_ROOT_DIR."inc/function.php"; 19 include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; 20 21 $link=connect(); 22 $html=''; 23 24 if(isset($_GET['submit']) && $_GET['name']!=null){ 25 //這裡沒有做任何處理，直接拼到select裡面去了 26 27 $name=addslashes($_GET['name']); 28 29 //這裡的變數是字元型，需要考慮閉合 30 $query="select id,email from member where username='$name'"; 31 $result=execute($link, $query); 32 if(mysqli_num_rows($result)>=1){ 33 while($data=mysqli_fetch_assoc($result)){ 34 $id=$data['id']; 35 $email=$data['email']; 36 $html.="<p class='notice'>your uid:{$id} <br />your email is: {$email}</p>"; 37 } 38 }else{ 39 40 $html.="<p class='notice'>您輸入的username不存在，請重新輸入！</p>"; 41 } 42 } 43 44 45 46 ?> 47 48 49 <div class="main-content"> 50 <div class="main-content-inner"> 51 <div class="breadcrumbs ace-save-state" id="breadcrumbs"> 52 <ul class="breadcrumb"> 53 <li> 54 <i class="ace-icon fa fa-home home-icon"></i> 55 <a href="sqli.php">sqli</a> 56 </li> 57 <li class="active">字元型注入</li> 58 </ul><!-- /.breadcrumb --> 59 60 <a href="#" style="float:right" data-container="body" data-toggle="popover" data-placement="bottom" title="tips(再點一下關閉)" 61 data-content="變數型別為字元型"> 62 點一下提示~ 63 </a> 64 65 </div> 66 <div class="page-content"> 67 68 69 <div id="sqli_main"> 70 <p class="sqli_title">what's your username?</p> 71 <form method="get"> 72 <input class="sqli_in" type="text" name="name" /> 73 <input class="sqli_submit" type="submit" name="submit" value="查詢" /> 74 </form> 75 <?php echo $html;?> 76 </div> 77 78 79 80 81 </div><!-- /.page-content --> 82 </div> 83 </div><!-- /.main-content --> 84 85 86 87 88 89 <?php 90 include_once $PIKA_ROOT_DIR . 'footer.php'; 91 92 ?>
在27行修改成如下程式碼$name=addslashes($_GET['name']);防止sql注入
當然方法有很多比如正則表示式等等
下面再用同樣的方法看看sql注入是否存在
可以發現sql注入已經不存在了
下面詳細看看這個函式的作用
PHP addslashes() 函式
例項
在每個雙引號（"）前新增反斜槓：
<?php
$str = addslashes('Shanghai is the "biggest" city in China.');
echo($str);
?>
執行結果Shanghai is the \"biggest\" city in China.
發現對雙引號之類的東西做了過濾
定義和用法
addslashes() 函式返回在預定義字元之前新增反斜槓的字串。
預定義字元是：
- 單引號（'）
- 雙引號（"）
- 反斜槓（\）
- NULL
提示：該函式可用於為儲存在資料庫中的字串以及資料庫查詢語句準備字串。
註釋：預設地，PHP 對所有的 GET、POST 和 COOKIE 資料自動執行 addslashes()。所以您不應對已轉義過的字串使用 addslashes()，因為這樣會導致雙層轉義。遇到這種情況時可以使用函式 get_magic_quotes_gpc() 進行檢測。
語法
addslashes(string)
| 引數 | 描述 |
|---|---|
| string | 必需。規定要轉義的字串。 |
例子 1
向字串中的預定義字元新增反斜槓：
<?php
$str = "Who's Bill Gates?";
echo $str . " This is not safe in a database query.<br>";
echo addslashes($str) . " This is safe in a database query.";
?>
執行結果
Who's Bill Gates? This is not safe in a database query.
Who\'s Bill Gates? This is safe in a database query.