import pymysql
db = pymysql.connect(host='localhost', port=3306, user='root', passwd='1234', db='test')
cursor = db.cursor()
username = '"随便" or 1=1 -- '
password = '随便'
# 下面这两种拼接方式都可能被注入sql,导致会有一个用户账号被获取
sql1 = 'select username, password from user where username="%s" and password="%s"' %(username,password)
sql2 = 'select username, password from user where username='+ username+'and password=' + password
print(sql1)
# select username, password from user where username=""随便" or 1=1 -- " and password="随便"
print(sql2)
# select username, password from user where username="随便" or 1=1 -- and password=随便
cursor.execute(sql2 )
data = cursor.fetchone()
print(data)
db.close()
sql注入的例子
最新推荐文章于 2024-05-08 21:46:20 发布