文章目录
文笔有限,大佬轻喷。
1. PWD
<?php error\_reporting(0); highlight\_file(\_\_FILE\_\_); $con = mysqli\_connect("localhost","root","root","ccut"); function waffff($sql) { if (preg\_match("/infor|sys|sql|thread|case|when|if|like|left|right|mid|cmp|sub|locate|position|match|find|field|sleep|repeat|lock|bench|process|<|>|=|xor|and|&&|\\\\/i", $sql)) { die("hacker"); } } if (isset($\_POST['password'])) { $password = $\_POST['password']; waffff($password); $sql = "SELECT password FROM users WHERE username='admin' and password='$password'"; $user\_result = mysqli\_query($con,$sql); $row = mysqli\_fetch\_array($user\_result); if ($row['password'] === $password) { include "/flag"; } else { echo "error"; } } ?>关键代码如下:
$password = $_POST[‘password’];
s q l = " S E L E C T p a s s w o r d F R O M u s e r s W H E R E u