|
|
| (18 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| =Vorüberlegung=
| | *[[Was ist eine SQL Injection]] |
| ==Verhaltensweise einer SQL Abfrage==
| | *[[SQL Injection Datenabfrage]] |
| ;Normale Abfrage
| | *[[SQL-Injection-Exploits]] |
| *MariaDB [sql_injections]> select * from users where username = 'rudi.burkart'; | | *[[SQL Injection - Übersicht]] |
| +------+--------------+----------+
| | *[[SQL Blind Injection]] |
| | id | username | password |
| | *[[Sql-Injection-Proof-of-Concept]] |
| +------+--------------+----------+
| |
| | 2 | rudi.burkart | secret |
| |
| +------+--------------+----------+
| |
| 1 row in set (0.000 sec)
| |
| ;Oder Verknüpfung
| |
| *MariaDB [sql_injections]> select * from users where username = 'rudi.burkart' or username = 'hans.will'; | |
| +------+--------------+----------+
| |
| | id | username | password |
| |
| +------+--------------+----------+
| |
| | 2 | rudi.burkart | secret |
| |
| | 1 | hans.will | geheim |
| |
| +------+--------------+----------+
| |
| 2 rows in set (0.000 sec)
| |
| =PHP Code=
| |
| ==Unsicher==
| |
| <pre>
| |
| <?php
| |
| error_reporting(E_ERROR | E_PARSE);
| |
| if(isset($_POST['submit'])){
| |
| define('DB_SERVER', 'db');
| |
| define('DB_USERNAME', 'xinux');
| |
| define('DB_PASSWORD', 'suxer');
| |
| define('DB_NAME', 'sql_injections');
| |
| $link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
| |
| mysqli_set_charset($link, "utf8");
| |
| if($link === false){
| |
| echo(mysqli_connect_error());
| |
| die("ERROR: Could not connect. " . mysqli_connect_error());
| |
| }
| |
| | |
| | |
| //connect db
| |
| include "inc/connect.php";
| |
| //safe query
| |
| $search = mysqli_real_escape_string($link, $_POST['search']);
| |
| //Database search
| |
| $sql = "SELECT * FROM users WHERE username='$search'";
| |
| $result = mysqli_query($link, $sql);
| |
| }
| |
| ?>
| |
| | |
| <!DOCTYPE html>
| |
| <html>
| |
| </pre>
| |
| | |
| | |
| | |
| [[Datei:Sql-injection-1.png]] | |