wechall php,WeChall 两道sql注入 基础题目 Write Up

[PHP] 纯文本查看 复制代码function auth2_onLogin(WC_Challenge $chall, $username, $password)

{

$db = auth2_db();

$password = md5($password);

$query = "SELECT * FROM users WHERE username='$username'";

if (false === ($result = $db->queryFirst($query))) {

echo GWF_HTML::error('Auth2', $chall->lang('err_unknown'), false);

return false;

}

#############################

### This is the new check ###

if ($result['password'] !== $password) {

echo GWF_HTML::error('Auth2', $chall->lang('err_password'), false);

return false;

} # End of the new code ###

#############################

echo GWF_HTML::message('Auth2', $chall->lang('msg_welcome_back', array(htmlspecialchars($result['username']))), false);

if (strtolower($result['username']) === 'admin') {

$chall->onChallengeSolved(GWF_Session::getUserID());

}

return true;

}