如何解决用PHP进行SQL注入攻击
您需要确保注释掉查询的其余部分，以免引号引起您的注意，因此任何多余的子句都将被忽略。
尝试将ID设置为：
0 OR id=id --
的--聽（这是连字符，连字符，空间：空间是很重要的）是在MysqL评论。
解决方法
这是我的计算机安全课程的作业的一部分，因此我不是在寻找特定的答案，而只是寻求帮助。
我们得到了一个错误的程序（使用php），该程序控制sql数据库（银行帐户），我们必须找到一种创建SQL注入攻击的方法，该攻击可使我们无需预先知道其ID即可登录到一个帐户。
我敢肯定，我知道该漏洞在哪里，但是我似乎无法使我的攻击起作用。
有问题的代码（虽然很长，但唯一重要的部分是第一部分）：
<html><head><title>FrobozzCo Community Credit Union</title></head>
<body>
<h1>FrobozzCo Community Credit Union</h1>
<h4><i>We're working for GUE</i></h4>
<hr>
<?php
$debugmode = 1;
function debug($msg) {
global $debugmode;
if ($debugmode) {
echo "<h4>$msg</h4>\n";
}
}
$thispage = 'FCCU.php';
echo "<form action='$thispage' method='post' name='theform'>\n";
$dbuser = 'fccu';
$dbpass = 'fccubucks';
$dbhost = 'localhost';
$dbname = $dbuser;
$PARAM = array_merge($_GET,$_POST);
// get username and password from form
if (!$PARAM['id'] || !$PARAM['password']) {
login();
} else { // otherwise,attempt to authenticate
$id = $PARAM['id'];
$password = $PARAM['password'];
$link_id = mysql_connect($dbhost,$dbuser,$dbpass);
mysql_select_db($dbname);
$query = "SELECT * FROM accounts WHERE id = $id AND password = '$password'";
debug($query);
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // there should be only one row
if (!$row) { // auth failure
echo "<p><b>Your ID number and password you entered do not match.</b></p>";
echo "<p>Please try again.</p>";
login();
} else { // this user is authenticated!
// store authentication information in this form
echo "<input type=\"hidden\" name=\"id\" value=\"$id\" />\n";
echo "<input type=\"hidden\" name=\"password\" value=\"$password\" />\n";
banner($row);
// perform any requested actions (wire,transfer,withdraw)
if ($PARAM['action'] == 'Transfer Money') {
transfer_funds($id,$password,$PARAM['transfer_to'],$PARAM['transfer_amount']);
} elseif ($PARAM['action'] == 'Wire Money') {
wire_funds($id,$PARAM['routing'],$PARAM['wire_acct'],$PARAM['wire_amount']);
} elseif ($PARAM['action'] == 'Withdraw Money') {
withdraw_cash($id,$PARAM['withdraw_amount']);
}
// normal output
// account info
$query = "SELECT * FROM accounts WHERE id = $id AND password = '$password'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // there should be only one row
account_info($row);
// get current account list by name
$query = "SELECT first,last FROM accounts ORDER BY last";
$names = mysql_query($query) or die(mysql_error());
account_actions($row,$names);
}
}
echo "<hr>\n";
echo "Generated by FCCU.php at " . date("l M dS,Y,H:i:s",5678)."<br>";
function name_to_id($name) {
global $dbhost,$dbpass,$dbname;
$splitname = explode(",",$name);
$link_id = mysql_connect($dbhost,$dbpass);
mysql_select_db($dbname);
$query = "SELECT id FROM accounts WHERE first = '$splitname[1]' AND last = '$splitname[0]'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result);
$id = $row[0];
return $id;
}
function action_error($msg,$error) {
echo "<table bgcolor='#ff0000' color='#ffffff' align=center border=1>
<tr><td><center><b>ERROR!</b></center></td></tr>
<tr><td>
<p align='center'>$msg</p>
<p align='center'>Please go back and try again or contact tech support.</p>
<p align='center'><i>args: $error</i></p>
<p align='center'><input type='submit' name='clear' value='Clear Message'></p>
</td></tr>
</table>";
}
function withdraw_cash($id,$amount) {
global $dbhost,$dbname;
$amount = floor($amount);
$link_id = mysql_connect($dbhost,$dbpass);
mysql_select_db($dbname);
$query = "SELECT bal FROM accounts WHERE password = '$password' AND id = $id";
debug("126: ($password) " . $query);
$result = mysql_query($query);
$row = mysql_fetch_array($result);
$giver_has = $row[0];
if ($amount > 0 && $giver_has >= $amount) {
$giver_has = $giver_has - $amount; // there's a problem here but it's not SQL Injection...
pretend("withdraw cash",$amount);
$query = "UPDATE accounts SET bal = $giver_has WHERE password = '$password' AND id = $id LIMIT 1";
mysql_query($query) or die(mysql_error());
echo "<h2 align='center'>Cash withdrawal of $$amount complete.</h2>
<h3 align='center'>Your cash should be ready in accounting within 45 minutes.</h3>\n";
} else {
action_error("Problem with cash withdrawal!","'$id','$giver_has','$amount'");
}
}
function wire_funds($id,$bank,$account,$dbpass);
mysql_select_db($dbname);
$query = "SELECT bal FROM accounts WHERE password = '$password' AND id = $id";
debug($query);
$result = mysql_query($query);
$row = mysql_fetch_array($result);
$giver_has = $row[0];
if ($amount > 0 && $giver_has >= $amount && $bank && $account) {
$giver_has = $giver_has - $amount; // there's a problem here but it's not SQL Injection...
pretend("wire money",$amount,$acct);
$query = "UPDATE accounts SET bal = $giver_has WHERE password = '$password' AND id = $id LIMIT 1";
debug($query);
mysql_query($query) or die(mysql_error());
echo "<h2 align='center'>Wire of $$amount to bank ($bank) account ($account) complete.</h2>\n";
} else {
action_error("Problem with wire fund transfer!",'$amount','$bank','$account'");
}
}
function pretend() {
return 1;
}
function transfer_funds($giver_id,$recipient,$dbname;
$amount = floor($amount);
$recipient_id = name_to_id($recipient);
$link_id = mysql_connect($dbhost,$dbpass);
mysql_select_db($dbname);
$query = "SELECT bal FROM accounts WHERE id = $giver_id OR id = $recipient_id";
debug($query);
$result = mysql_query($query);
$row = mysql_fetch_array($result);
$recipient_has = $row[0];
$row = mysql_fetch_array($result);
$giver_has = $row[0];
debug("$giver_has,$recipient_has");
if ($amount > 0 && $giver_has >= $amount && $recipient_has) {
$giver_has = $giver_has - $amount; // there's a problem here but it's not SQL Injection...
$recipient_has = $recipient_has + $amount; // does anyone know what it is?
$query = "UPDATE accounts SET bal = $recipient_has WHERE id = $recipient_id LIMIT 1";
debug($query);
mysql_query($query) or die(mysql_error());
$query = "UPDATE accounts SET bal = $giver_has WHERE password = '$password' AND id = $giver_id LIMIT 1";
debug($query);
mysql_query($query) or die(mysql_error());
echo "<h2 align='center'>Transfer of $$amount to $recipient complete.</h2>\n";
} else {
action_error("Problem with employee fund transfer!","'$giver_id','$recipient','$giver_has'");
}
}
function account_info($row) {
echo "<table border='1' align='center'>
<tr><td colspan='2'><p><center><b>Account Information</b></center></p></td></tr>
<tr><td><b>Account:</b></td><td>$row[0]</td></tr>
<tr><td><b>Balance:</b></td><td>$$row[1]</td></tr>
<tr><td><b>Birthdate:</b></td><td>$row[6]</td></tr>
<tr><td><b>SSN:</b></td><td>$row[5]</td></tr>
<tr><td><b>Phone:</b></td><td>$row[4]</td></tr>
<tr><td><b>Email:</b></td><td>$row[7]@frobozzco.com</td></tr>
</table>\n";
}
function account_actions($row,$names) {
global $thispage;
echo "<table border=1 width='600' align='center'>
<tr><td><center><b>Account Actions</b></center></td></tr>
<tr><td><center><b>Wire Funds</b></center></td></tr>
<tr><td>
<p>To wire funds: enter the amount (in whole dollars),the
receiving bank's <b>routing number</b> and <b>receiving account number</b>,and press 'Wire Funds!'</p>
Wire amount: $<input name=wire_amount /><br />
Routing Number: <input name=routing /> (e.g. 091000022)<br />
Account Number: <input name=wire_acct /> (e.g. 923884509)<br />
<p align='center'><input type='submit' name='action' value='Wire Money'></p>
<p />
</td></tr>
<tr><td><center><b>Transfer Money</b></center></td><tr>
<tr><td><p>To transfer money to another FCCU account holder,select the
employee from the drop-down menu below,enter an ammount (in whole dollars)
to transfer,and press 'Transfer Money!'</p>
Transfer Amount: $<input name=transfer_amount /><br />
Transfer To: ";
// create dropdown menu with accounts
echo "<select name='transfer_to' selected='select employee'>\n";
echo "<option value='nobody'>select employee</option>\n";
while ($name = mysql_fetch_array($names)) {
echo "<option value=\"$name[1],$name[0]\">$name[1],$name[0]</option>\n";
}
echo "</select>\n";
echo "<br />
<p align='center'><input type='submit' name='action' value='Transfer Money'></p>
<p />
</td></tr>
<tr><td><center><b>Withdraw Cash</b></center></td><tr>
<tr><td><p>To withdraw cash,enter an amount (in whole dollars) and press
the 'Withdraw Cash!' button. The cash will be available in the accounting
office within 45 minutes.</p>
Withdraw Amount: $<input name=withdraw_amount /><br />
<p align='center'><input type='submit' name='action' value='Withdraw Money'></p>
<p />
</td></tr>
</table>
\n";
}
function banner($row) {
global $thispage;
$fullname = "$row[2] $row[3]";
echo "<table width='100%'><tr><td>
<p align='left'>Welcome,$fullname. (<a href='$thispage'>Log Out</a>)</p>
</td><td>
<p align='right'><i>(If you aren't $fullname,<a href='$thispage'>click here</a>.)</i></p>
</td></tr></table>\n";
echo "<hr>\n";
}
function login() {
global $thispage;
echo "<p>Enter your <b>account ID</b> and password and click \"submit.\"</p>\n";
echo "<table>\n";
echo "<tr><td>Account ID Number: </td><td><input name='id' cols='10' /></td></tr>\n";
echo "<tr><td>Password (alphanumeric only): </td><td><input name='password' cols='30' /></td></tr>\n";
echo "<tr><td><input type='submit' value='Submit' name='submit'></td><td></td></tr>\n";
echo "</table>\n";
}
?>
</form>
<p>Done.</p>
</body>
</html>
该行：
$query = "SELECT * FROM accounts WHERE id = $id AND password = '$password'";
我已经尝试了ID输入中的几个字符串（我正在使用浏览器工作），例如
100 OR id=id;
0 OR 1=1;
尝试注释掉命令的密码部分。我对SQL还是很陌生，所以我认为我只是在格式化错误。
那或者我完全忽略了一个更明显的漏洞。
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。
