如何通过SQL注入更新列？

发布于 2025-01-01 12:29:50 字数 210 浏览 0 评论 0原文

我没有找到太多这方面的信息，但我听说可以在 URL 栏中输入 SQL 查询以从数据库中提取数据，我只是想知道是否也可以通过它更新列或表。

下面是一个示例：

SELECT * 
FROM table 
WHERE 1 = '2' 
AND 3 = '$input'

是否可以在 URL 栏中使用更新查询？如果可以，如何进行？

原文

I haven't found much information on this, but I heard it is possible to enter SQL queries into the URL bar to extract data from a database, I was just wondering if it was also possible to update a column or table through it.

Here's an example:

SELECT * 
FROM table 
WHERE 1 = '2' 
AND 3 = '$input'

Is using an update query in the URL bar possible, and if so, how?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

橪书 2025-01-08 12:29:50

如果有人创建这样的 SQL 查询字符串

 sql = "SELECT * FROM table WHERE name = '" & input & "';"

，那么如果输入是

input = "John'; DELETE FROM table WHERE 'x'='x"

结果 SQL

SELECT * FROM table WHERE name = 'John'; DELETE FROM table WHERE 'x'='x';

将包含两个 SQL 语句。然后第二个可以做注射器想做的任何事情。

有两种可能性可以防止这种情况发生。

1

转义输入中的单引号，

 sql = "SELECT * FROM table WHERE name = '" & Replace(input, "'", "''") & "';"

将错误的输入转换为字符串的一部分

SELECT * FROM table WHERE name = 'John''; DELETE FROM table WHERE ''x''=''x';

2

使用参数而不是字符串连接

cmd = new Command("SELECT * FROM table WHERE name = @n")  
cmd.AddParameter("@n", input)  
result = cmd.Execute()

详细信息取决于数据库、数据库访问技术和所使用的编程语言。我的例子必须被理解为伪代码。

If someone creates a SQL query string like this

 sql = "SELECT * FROM table WHERE name = '" & input & "';"

then if the input is

input = "John'; DELETE FROM table WHERE 'x'='x"

The resulting SQL will be

SELECT * FROM table WHERE name = 'John'; DELETE FROM table WHERE 'x'='x';

It will contain two SQL statements. The second one can then do about anything the injector wants.

There are two possibilities to prevent this to happen.

1

Escape the single quotes in the input

 sql = "SELECT * FROM table WHERE name = '" & Replace(input, "'", "''") & "';"

turning the bad input into a part of the string

SELECT * FROM table WHERE name = 'John''; DELETE FROM table WHERE ''x''=''x';

2

Use parameters instead of string concatenation

cmd = new Command("SELECT * FROM table WHERE name = @n")  
cmd.AddParameter("@n", input)  
result = cmd.Execute()

The details depend on the database, the database access technology and the programming language used. My examples have to be understood as pseudo code.

回复收藏 0 原文

~没有更多了~