本文最后更新于：2021年11月30日凌晨

🛢️SQL注入

⭕实例代码，仅供测试⭕

## 环境准备

搭建数据库基本环境

create database myDB;		# 创建数据库
use myDB;		# 进入数据库
CREATE TABLE sqljection (
      id INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
      username VARCHAR(64) UNIQUE NOT NULL,
      password VARCHAR(64) NOT NULL,
      email VARCHAR(64) NOT NULL)
      ENGINE=MyISAM AUTO_INCREMENT=917432  DEFAULT CHARSET=latin1;		# 创建表

创建注册用户页面

先进入网页的根目录

1	`cd /var/www/html/`

创建网页文件

1	`vim zuche.php`

<html>
<title>This is a SQLjection!</title>
<body>
<form action="" method="post">
    Username:<input type="text" name="username"/>
    Password:<input type="text" name="pswd"/>
    Email:<input type="text" name="email"/>
    <input type="submit" value="插入数据"/>
</form>
<?php
  $hostname="localhost";
  $username="root";
  $password="123456";
  $database="myDB";
 $conn=new mysqli($hostname,$username,$password,$database);
 $str1=ltrim($_POST['username']);
 $str2=md5(ltrim($_POST['pswd']));
 $str3=ltrim($_POST['email']);
 $sql="INSERT INTO sqljection(username,password,email) VALUES('$str1','$str2','$str3')";
 if(($str1<>NULL)&&($str2<>NULL))
   {
    $conn->query($sql);
   }
$conn->close();
?>
</body>
</html>

打开效果：

创建登录页面

1	`vim login.html`

<html>
<title>This is a login about sqljection</title>
<body>
  <form action="checklogin.php" method="post">
  <fieldset >
    <legend>Sql注入演示</legend>
    <table>
      <tr>
        <td>用户名：</td>
        <td><input type="text" name="username"></td>
      </tr>
     <tr>
        <td>密&nbsp;&nbsp;码：</td>
        <td><input type="text" name="password"></td>
      </tr>
      <tr>
        <td><input type="submit" value="提交"></td>
        <td><input type="reset" value="重置"></td>
      </tr>
    </table>
  </fieldset>
</form>
</body>
</html>

1	`vim checklogin.php`

<html>
<head>
<title>登录验证</title>
<meta http-equiv="content-type"content="text/html;charset=utf-8">
</head>
<body>
<?php
   $servername = "localhost";
   $username ="root";
   $password ="123456";
   $dbname = "myDB";
// 创建连接
   $conn = new mysqli($servername, $username, $password, $dbname);
   $name=$_POST["username"];
   $pwd=md5($_POST["password"]);
   $sql="select * from sqljection where username='$name' and password='$pwd'";
   $result = $conn->query($sql);
   if ($result->num_rows > 0) {
    // 输出数据
    while($row = $result->fetch_assoc()) {
      echo "<h2>";
       echo "id: " . $row["id"]. ", <br> username is: " . $row["username"]. ",  <br> password is: " . $row["password"].",  <br> email is: " . $row["email"]. "<br>";
    }
} else {
    echo "<h2>您的用户名或密码输入有误，<a href=\"login.html\">请重新登录！</a>";
}
$conn->close();
 ?>
</body>
</html>