sql注入报错注入实例_SQL注入用语法示例解释

sql注入报错注入实例

SQL注入如何工作 (How SQL Injection Works)

SQL injection is a malicious technique that is meant to compromise or destroy databases. It is one of the most common web-hacking techniques.

SQL注入是一种恶意技术，旨在破坏或破坏数据库。 它是最常见的网络黑客技术之一。

SQL injection is performed by placing malicious code in SQL statements via an input.

通过将恶意代码通过输入放置在SQL语句中来执行SQL注入。

You may have heard of SQL Injection before. It is immortalized in this famous XKCD comic:

您可能以前听说过SQL注入。 在这部著名的XKCD漫画中它永生不朽：

The following example is a code snippet that will retrieve a user from a database based on an  AccountId .

以下示例是一个代码片段，它将基于AccountId从数据库中检索用户。

passedInAccountId = getRequestString("AccountId");
sql = "select * from Accounts where AccountId = " + passedInAccountId;

SQL injection can be used to compromise this code by injecting a  1=1;  statement for  AccountId .

SQL注入可通过注入1=1;来破坏此代码1=1; AccountId语句。

https://www.foo.com/get-user?AccountId="105 OR 1=1;"

https://www.foo.com/get-user?AccountId="105 OR 1=1;"

1=1  will always evaluate to  TRUE . This will cause the executed code to output all of the Accounts table.

1=1将始终计算为TRUE 。 这将导致执行的代码输出所有“帐户”表。

Comic: https://imgs.xkcd.com/comics/exploits_of_a_mom.png

漫画： https ： //imgs.xkcd.com/comics/exploits_of_a_mom.png

翻译自: https://www.freecodecamp.org/news/sql-injection-explained-with-syntax-examples/

sql注入报错注入实例