我需要做一个关于SQL注入的演示,最好的方法是自己编写PHP查询并展示给同学们。问题在于我的数据库和PHP代码都运行良好,但是在我制作的编辑表单中无法找到UPDATE查询的漏洞。
如果有人能够查看一下并告诉我如何插入例如'DROP TABLE'之类的命令,那将非常有帮助!
<?php
session_start();
require_once 'config.php';
error_reporting(E_ALL);
ini_set('display_errors', 1);
$userid = $_SESSION["userid"];
$fname = $_SESSION["fname"];
$lname = $_SESSION["lname"];
$gender = $_SESSION["gender"];
$email = $_SESSION["email"];
if($_SERVER["REQUEST_METHOD"] == "POST") {
$userid = trim($_POST["userid"]);
$fname = trim($_POST["fname"]);
$lname = trim($_POST["lname"]);
$gender = trim($_POST["gender"]);
$email = trim($_POST["email"]);
$query = "UPDATE user_details SET fname = '$fname', lname = '$lname', gender = '$gender', email = '$email' WHERE userid = '$userid' ";
if (mysqli_query($link, $query)) {
echo 'Update complete!';
}
echo mysqli_error($link);
// else {
// echo '<p>' . 'Woah something went really wrong dude' . '</p>' ;
// echo mysqli_error($link);
// }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Edit</title>
<link rel="stylesheet" href="bootstrap.css">
<style type="text/css">
body{ font: 14px sans-serif; }
.wrapper{ width: 350px; padding: 20px; }
</style>
</head>
<body>
<div class="container">
<form class= "form-inline" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<label>First Name</label>
<input type="text" name="fname" class="form-control" value="<?php echo $_SESSION["fname"]; ?>">
<label>Last Name</label>
<input type="text" name="lname" class="form-control" value="<?php echo $_SESSION["lname"]; ?>">
<label>Gender</label>
<input type="text" name="gender" class="form-control" value="<?php echo $_SESSION["gender"]; ?>">
<label>Email</label>
<input type="text" name="email" class="form-control" value="<?php echo $_SESSION["email"]; ?>">
</div>
<div class = "wrapper">
<label>UserID</label>
<input type="text" name="userid" class="form-control" value="<?php echo $_SESSION["userid"]; ?>">
<button type="submit">Submit</button>
</form>
<form action="action.php"><button type="submit">Back</button></form>
</div>
</body>
</html>
UPDATE user_details SET fname = (SELECT SLEEP(5)) --
- Raymond Nijland