开发者

Successful SQL Injection despite PHP Magic Quotes

开发者 https://www.devze.com 2022-12-28 19:08 出处:网络
I have always read that Magic Quotes do not stop SQL Injections at all but I am not able to understand why not! As an example, let\'s say we have the following query:

I have always read that Magic Quotes do not stop SQL Injections at all but I am not able to understand why not! As an example, let's say we have the following query:

SELECT * FROM tablename
  WHERE email='$x';

Now, if the user input makes $x=' OR 1=1 --, the query would be:

SELECT * FROM tablename
  WHERE email='\' OR 1=1 --';

The backslash will be added by Magic Quotes with no damage done whatsoever!

Is there a way that I am not seeing where the user can bypass the Ma开发者_如何学Pythongic Quote insertions here?


The trick is usually to pass a binary value so that the backslash would become a part of valid multibyte character. Here is a blog post about it.

0

精彩评论

暂无评论...
验证码 换一张
取 消