使用 union 和 load_file() 进行 SQL 注入

发布于 2024-11-18 11:32:40 字数 185 浏览 3 评论 0原文

我的网站遭到 SQL 注入攻击。黑客在 URL 查询字符串中使用以下内容：

abc-buy.php?sid=144760&op=-3+union+all+select+1,2,3,4,5,6,7,load_file%28%22/etc/passwd%22%29

如何避免此类攻击？

原文

My website has been attacked by SQL injection. Hacker used following in URL query string:

abc-buy.php?sid=144760&op=-3+union+all+select+1,2,3,4,5,6,7,load_file%28%22/etc/passwd%22%29

How can I avoid these kind of attacks?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

洛阳烟雨空心柳 2024-11-25 11:32:40

始终验证不受信任的输入。
所有输入都是不可信的。

如何验证输入取决于输入是什么，但在这种情况下，很明显 -3+union+all+select+1,2,3,4,5,6,7,load_file% 28%22/etc/passwd%22%29 不是 op 的有效输入（无论 op 是什么）。

因此，在这种情况下，可能就像添加一些代码来检查“op”的值是否与预期值之一匹配一样简单。

if ( op != "or" and op != "and" and op != "monkeys" ) {
    raise_exception("Invalid op specified! Go away you trickster!");
}

您应该对从用户处收到的每个值执行此操作。尽管对于自由格式字段（例如电子邮件地址或评论等）而言，这比较棘手。但是，请确保它们是所匹配字段的有效数据，并在将任何自由格式字段插入数据库之前对其进行转义。这可能会造成以下差异：

INSERT INTO users (username,fullname) VALUES ("bob","Robert"); DROP TABLE users; SELECT 1 WHERE "x"="");

和：

INSERT INTO users(username,fullname) VALUES ("bob",Robert\"\)\; DROP TABLE users\; SELECT 1 WHERE \"x\"=\"");

功能差异在于，对于第一个（未转义）版本，会执行 DROP TABLE users; 命令，而对于第二个版本，您只需插入一个新用户有一个又长又傻的名字 Robert")；删除表用户；SELECT 1 WHERE "x"="。

Always validate untrusted input.
All input is untrusted.

How to validate the input depends on what the input is, but in this case, it's probably pretty obvious that -3+union+all+select+1,2,3,4,5,6,7,load_file%28%22/etc/passwd%22%29 is not valid input for op (whatever op is).

So in this case, it would probably be as simple as adding some code to check that the value for "op" matches one of the expected values.

if ( op != "or" and op != "and" and op != "monkeys" ) {
    raise_exception("Invalid op specified! Go away you trickster!");
}

You should do this for every value you receive from users. Although it's trickier for free-form fields, like email addresses or comments, etc. But still, make sure they are valid data for the field they're matching--and escape any free-form fields before you insert them into the database. That can make the difference between:

INSERT INTO users (username,fullname) VALUES ("bob","Robert"); DROP TABLE users; SELECT 1 WHERE "x"="");

and:

INSERT INTO users(username,fullname) VALUES ("bob",Robert\"\)\; DROP TABLE users\; SELECT 1 WHERE \"x\"=\"");

The functional difference being that with the first (un-escaped) version, the DROP TABLE users; command executes, and with the second, you simply insert a new user with a really long, silly name of Robert"); DROP TABLE users; SELECT 1 WHERE "x"=".

回复收藏 0 原文