sql注入报错注入实例
SQL注入如何工作 (How SQL Injection Works)
SQL injection is a malicious technique that is meant to compromise or destroy databases. It is one of the most common web-hacking techniques.
SQL注入是一种恶意技术,旨在破坏或破坏数据库。 它是最常见的网络黑客技术之一。
SQL injection is performed by placing malicious code in SQL statements via an input.
通过将恶意代码通过输入放置在SQL语句中来执行SQL注入。
You may have heard of SQL Injection before. It is immortalized in this famous XKCD comic:
您可能以前听说过SQL注入。 在这部著名的XKCD漫画中它永生不朽:
The following example is a code snippet that will retrieve a user from a database based on an AccountId
.
以下示例是一个代码片段,它将基于AccountId
从数据库中检索用户。
passedInAccountId = getRequestString("AccountId");
sql = "select * from Accounts where AccountId = " + passedInAccountId;
SQL injection can be used to compromise this code by injecting a 1=1;
statement for AccountId
.
SQL注入可通过注入1=1;
来破坏此代码1=1;
AccountId
语句。
https://www.foo.com/get-user?AccountId="105 OR 1=1;"
https://www.foo.com/get-user?AccountId="105 OR 1=1;"
1=1
will always evaluate to TRUE
. This will cause the executed code to output all of the Accounts table.
1=1
将始终计算为TRUE
。 这将导致执行的代码输出所有“帐户”表。
Comic: https://imgs.xkcd.com/comics/exploits_of_a_mom.png
漫画: https : //imgs.xkcd.com/comics/exploits_of_a_mom.png
翻译自: https://www.freecodecamp.org/news/sql-injection-explained-with-syntax-examples/
sql注入报错注入实例