What if $unescapedstring is set to cake';DROP TABLE 'table';--? That'll execute the select, followed by the DROP TABLE statement. Replace the drop table with whatever sql you want, and you've got yourself the ability to execute any SQL. They can download your database, or wipe it, or modify records...just don't do it. Sanitize your inputs! Otherwise, your users have free reign on your database.
虽然其他答案完全正确，但如果您的 mysql 用户帐户设置正确，则执行这些查询的帐户可能不应该具有更改/创建/删除表/数据库的权限。因此，在这种情况下可能发生的最糟糕的情况是：DELETE FROM table
While the other answers are completely correct, if you have your mysql user accounts set up correctly, the account executing those queries probably shouldn't have permissions to alter/create/drop tables/databases. Therefore, worst that could happend in that scenario: DELETE FROM table
The worst that can happen? I'd say that anything can happen with that query.
For example, I submit this:
unescapedstring: '; (any other query)
Now, your query becomes:
SELECT * FROM table WHERE id=''; (any other query)
From there, I have the ability to execute any MySQL command. I can drop your whole database, I can edit it, I can download your database, and if your server permits, I can even go as far as rooting your actual server.
Basically, the attacker has full access to your MySQL installation. Expect anything.
发布评论
评论（3）
如果
$unescapedstring设置为cake';DROP TABLE 'table';--会怎样？这将执行 select，然后执行 DROP TABLE 语句。将删除表替换为您想要的任何 SQL，您就可以执行任何 SQL。他们可以下载您的数据库，或者擦除它，或者修改记录......只是不要这样做。净化您的输入！否则，您的用户可以自由支配您的数据库。What if
$unescapedstringis set tocake';DROP TABLE 'table';--? That'll execute the select, followed by the DROP TABLE statement. Replace the drop table with whatever sql you want, and you've got yourself the ability to execute any SQL. They can download your database, or wipe it, or modify records...just don't do it. Sanitize your inputs! Otherwise, your users have free reign on your database.虽然其他答案完全正确，但如果您的 mysql 用户帐户设置正确，则执行这些查询的帐户可能不应该具有更改/创建/删除表/数据库的权限。因此，在这种情况下可能发生的最糟糕的情况是：
DELETE FROM tableWhile the other answers are completely correct, if you have your mysql user accounts set up correctly, the account executing those queries probably shouldn't have permissions to alter/create/drop tables/databases. Therefore, worst that could happend in that scenario:
DELETE FROM table可能发生的最坏情况？我想说，该查询任何事情都可能发生。
例如，我提交：
现在，您的查询变为：
从那里，我有能力执行任何 MySQL命令。我可以删除你的整个数据库，我可以编辑它，我可以下载你的数据库，如果你的服务器允许，我什至可以root你的实际服务器。
基本上，攻击者可以完全访问您的 MySQL 安装。期待任何事情。
The worst that can happen? I'd say that anything can happen with that query.
For example, I submit this:
Now, your query becomes:
From there, I have the ability to execute any MySQL command. I can drop your whole database, I can edit it, I can download your database, and if your server permits, I can even go as far as rooting your actual server.
Basically, the attacker has full access to your MySQL installation. Expect anything.