—————— 搜尋型注入 加固
阿新 • • 發佈：2022-04-18
直接輸入%進行查詢，因為沒有做過濾，%在資料庫的查詢中匹配任意字元
原始碼
1 <?php 2 /** 3 * Created by runner.han 4 * There is nothing new under the sun 5 */ 6 7 8 $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); 9 10 if ($SELF_PAGE = "sqli_search.php"){ 11 $ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','');View Code12 } 13 14 $PIKA_ROOT_DIR = "../../"; 15 include_once $PIKA_ROOT_DIR . 'header.php'; 16 17 include_once $PIKA_ROOT_DIR."inc/config.inc.php"; 18 include_once $PIKA_ROOT_DIR."inc/function.php"; 19 include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; 20 21 $link=connect(); 22 $html1=''; 23 $html2=''; 24 if(isset($_GET['submit']) && $_GET['name']!=null){ 25 26 //這裡沒有做任何處理，直接拼到select裡面去了 27 $name=$_GET['name']; 28 29 //這裡的變數是模糊匹配，需要考慮閉合 30 $query="select username,id,email from member where username like '%$name%'"; 31 $result=execute($link, $query); 32 if(mysqli_num_rows($result)>=1){33 //彩蛋:這裡還有個xss 34 $html2.="<p class='notice'>使用者名稱中含有{$_GET['name']}的結果如下：<br />"; 35 while($data=mysqli_fetch_assoc($result)){ 36 $uname=$data['username']; 37 $id=$data['id']; 38 $email=$data['email']; 39 $html1.="<p class='notice'>username：{$uname}<br />uid:{$id} <br />email is: {$email}</p>"; 40 } 41 }else{ 42 43 $html1.="<p class='notice'>0o。..沒有搜尋到你輸入的資訊！</p>"; 44 } 45 } 46 47 48 49 ?> 50 51 52 <div class="main-content"> 53 <div class="main-content-inner"> 54 <div class="breadcrumbs ace-save-state" id="breadcrumbs"> 55 <ul class="breadcrumb"> 56 <li> 57 <i class="ace-icon fa fa-home home-icon"></i> 58 <a href="sqli.php">sqli</a> 59 </li> 60 <li class="active">搜尋型注入</li> 61 </ul><!-- /.breadcrumb --> 62 63 <a href="#" style="float:right" data-container="body" data-toggle="popover" data-placement="bottom" title="tips(再點一下關閉)" 64 data-content="%%"> 65 點一下提示~ 66 </a> 67 68 </div> 69 <div class="page-content"> 70 71 72 <div id="sqli_main"> 73 <p class="sqli_title">請輸入使用者名稱進行查詢<br />如果記不住使用者名稱，輸入使用者名稱的一部分搜尋的試試看？</p> 74 <form method="get"> 75 <input class="sqli_in" type="text" name="name" /> 76 <input class="sqli_submit" type="submit" name="submit" value="搜尋" /> 77 </form> 78 <?php echo $html2;echo $html1;?> 79 </div> 80 81 82 83 </div><!-- /.page-content --> 84 </div> 85 </div><!-- /.main-content --> 86 87 88 89 90 91 <?php 92 include_once $PIKA_ROOT_DIR . 'footer.php'; 93 94 ?>