[求助]为什么这个简单的例子不能实现SQL注入drop table？
发表于:
2018-4-20 20:05
2031
[求助]为什么这个简单的例子不能实现SQL注入drop table？
DDL如下
CREATE DATABASE sqlinjection;
use sqlinjection;
CREATE TABLE orderstable (
id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
description VARCHAR(100) NOT NULL,
shipcity VARCHAR(50) NOT NULL,
reg_date TIMESTAMP
);
INSERT INTO OrdersTable (description, shipcity) VALUES ("an order", "BeiJing");
INSERT INTO OrdersTable (description, shipcity) VALUES ("another order", "TaiBei");
a.html
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled</title>
</head>
<body>
<form name="frm1" id="frm1" action="a.php" method="GET">
ship city: <input type="text" id="city" name="city">
<input type="submit" id="btnSubmit" name="btnSubmit">
</form>
</body>
</html>
a.php
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled</title>
</head>
<body>
<?php
$servername = "localhost";
$username = "root";
$password = "*********";
$dbname = "sqlinjection";
// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("连接失败: " . $conn->connect_error);
}
$shipcity = $_REQUEST['city'];
$sql = "SELECT * FROM orderstable where shipcity='" . $shipcity . "'";
//$sql = "SELECT * FROM orderstable where shipcity = 'BeiJing';drop table orderstable-- '";
$result = $conn->query($sql);
//if($result == NULL) {
// echo "查询出错。";
// $conn->close();
// die(0);
//}
if ($result->num_rows > 0) {
// 输出数据
while($row = $result->fetch_assoc()) {
echo "id: " . $row["id"]. " - description: " . $row["description"]. " " . "ship city: ". $row["shipcity"]. "<br>";
}
} else {
echo "0 结果";
}
$conn->close();
?>
</body>
</html>
在MySql里直接执行SQL可以实现。a.html的文本框里填入 BeiJing';drop table orderstable--注意末尾的空格，但是不管用，报错
Notice: Trying to get property of non-object in C:\xampp\htdocs\a.php on line 31
。
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
