PHP实现SQL注入检测示例大全_sql 注入示例 php-优快云博客

本文链接：https://blog.youkuaiyun.com/jjj_web/article/details/148570766

SQL注入检测示例大全

以下是多种SQL注入检测方法和示例，涵盖不同场景和技术：

1. 基础检测方法

basic_detection.php


function basicSQLiDetection($input) {
    $dangerousPatterns = [
        '/\b(union\s+select)\b/i',
        '/\b(insert|update|delete|drop|alter)\b/i',
        '/\b(exec|execute|xp_cmdshell)\b/i',
        '/\b(or\s+1\s*=\s*1)\b/i',
        '/;\s*(--|#)/',
        '/sleep\(\d+\)/i'
    ];
    
    foreach ($dangerousPatterns as $pattern) {
        if (preg_match($pattern, $input)) {
            return true;
        }
    }
    return false;
}

基础检测函数包含常见SQL注入关键词和模式匹配。

2. 编码注入检测

encoding_detection.php

 detectEncodedInjection($input) {
    $encodedPatterns = [
        '/%27|\x27/i',        // 单引号
        '/%22|\x22/i',        // 双引号
        '/%3B|\x3B/i',        // 分号
        '/%2D%2D|\x2D\x2D/i', // --
        '/%25/i',             // 百分号
        '/0x[0-9a-f]+/i'      // 十六进制
    ];
    
    // 检测多重编码
    $decoded = urldecode(urldecode($input));
    if ($decoded != $input) {
        foreach ($encodedPatterns as $pattern) {
            if (preg_match($pattern, $decoded)) {
                return true;
            }
        }
    }
    
    return false;
}

此函数检测经过编码的SQL注入尝试，包括多重URL编码和十六进制编码。

3. 时间盲注检测

time_based_detection.php

 detectTimeBasedInjection($query) {
    $timePatterns = [
        '/benchmark\(\d+,\s*\w+\)/i',
        '/sleep\(\d+\)/i',
        '/waitfor\s+delay\s+\'\d+:\d+:\d+\'/i',
        '/pg_sleep\(\d+\)/i'
    ];
    
    foreach ($timePatterns as $pattern) {
        if (preg_match($pattern, $query)) {
            return true;
        }
    }
    
    // 检测异常延迟
    $start = microtime(true);
    $result = db_query($query);
    $duration = microtime(true) - $start;
    
    return $duration > 2.0; // 超过2秒视为可疑
}

时间盲注检测函数识别可能导致数据库延迟执行的恶意查询。

4. 错误注入检测

error_based_detection.php

 detectErrorBasedInjection($input) {
    $errorPatterns = [
        '/convert\(int,\s*@@version\)/i',
        '/extractvalue\(\d+,\s*concat\(\'/i',
        '/updatexml\(\d+,\s*concat\(\'/i',
        '/exp\(\d+\)/i',
        '/geometrycollection\(\'/i'
    ];
    
    foreach ($errorPatterns as $pattern) {
        if (preg_match($pattern, $input)) {
            return true;
        }
    }
    
    // 检测异常错误信息
    try {
        $result = db_query($input);
    } catch (Exception $e) {
        if (strpos($e->getMessage(), 'SQL syntax') !== false) {
            return true;
        }
    }
    
    return false;
}

错误注入检测函数识别试图通过错误消息获取信息的攻击模式。

5. 二阶注入检测

second_order_detection.php

class SecondOrderInjectionDetector {
    private $storedInputs = [];
    
    public function storeInput($key, $value) {
        $this->storedInputs[$key] = $value;
    }
    
    public function checkSecondOrderInjection($query) {
        foreach ($this->storedInputs as $value) {
            if (strpos($query, $value) !== false) {
                $dangerous = basicSQLiDetection($value) || 
                            detectEncodedInjection($value);
                if ($dangerous) {
                    return true;
                }
            }
        }
        return false;
    }
}

二阶注入检测类监控存储后使用的数据，防止延迟触发的SQL注入。

6. 自动化测试脚本

sql_injection_tester.php

 SQLInjectionTester {
    private $testCases = [
        // 基础注入
        "' OR 1=1 -- ",
        "\" OR \"a\"=\"a",
        "admin'--",
        // 联合查询
        "1 UNION SELECT username, password FROM users",
        // 盲注
        "1 AND (SELECT COUNT(*) FROM users) > 0",
        // 时间盲注
        "1; SELECT BENCHMARK(5000000, ENCODE('test','slow')) --",
        // 编码注入
        "%27%20OR%201%3D1",
        // 存储过程
        "1; EXEC xp_cmdshell('dir') --"
    ];
    
    public function testApplication($url, $params) {
        $results = [];
        
        foreach ($this->testCases as $testCase) {
            foreach ($params as $param => $value) {
                $testParams = $params;
                $testParams[$param] = $testCase;
                
                $response = $this->sendRequest($url, $testParams);
                
                $results[] = [
                    'param' => $param,
                    'payload' => $testCase,
                    'status' => $this->analyzeResponse($response)
                ];
            }
        }
        
        return $results;
    }
    
    private function sendRequest($url, $params) {
        // 实现HTTP请求发送逻辑
    }
    
    private function analyzeResponse($response) {
        // 分析响应是否显示注入成功迹象
    }
}

自动化测试脚本包含多种注入测试用例，可对Web应用进行系统化测试。

7. 防御性编码示例

secure_coding.php

class SecureDatabase {
    private $pdo;
    
    public function __construct() {
        $this->pdo = new PDO('mysql:host=localhost;dbname=test', 'user', 'pass', [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_EMULATE_PREPARES => false
        ]);
    }
    
    // 安全查询方法
    public function safeQuery($sql, $params = []) {
        $stmt = $this->pdo->prepare($sql);
        
        foreach ($params as $key => $value) {
            $type = is_int($value) ? PDO::PARAM_INT : PDO::PARAM_STR;
            $stmt->bindValue($key, $value, $type);
        }
        
        $stmt->execute();
        return $stmt->fetchAll(PDO::FETCH_ASSOC);
    }
    
    // 动态表名安全处理
    public function queryFromTable($table, $conditions = []) {
        $allowedTables = ['users', 'products', 'orders'];
        
        if (!in_array($table, $allowedTables)) {
            throw new Exception("Invalid table name");
        }
        
        $where = '';
        $params = [];
        
        foreach ($conditions as $column => $value) {
            $where .= " AND `$column` = :$column";
            $params[":$column"] = $value;
        }
        
        $sql = "SELECT * FROM `$table` WHERE 1=1 $where";
        return $this->safeQuery($sql, $params);
    }
}