Question

我之前在使用 MySQL, 并被告知这是不安全的, 所以现在我重新编码了在 PDO 中的管理员登录板, 用户和其他论坛都说不能注射。但是黑客仍然在进入... 我编辑了登录后的网页, 告诉黑客告诉我我在上面放了什么, 黑客告诉我...

我需要知道我的密码是否安全他告诉我他通过SQL进入

所以我首先把他们的IP存储在会话中, 所以如果他们的IP更改了, 它会把它们记录出来( 或用户名)

if ( isset($_SESSION[ last_ip ]) == false )
{
    $_SESSION[ last_ip ] = $_SERVER[ REMOTE_ADDR ];
}
if ( $_SESSION[ last_ip ] !== $_SERVER[ REMOTE_ADDR ] )
{
    session_unset();
    session_destroy();
}

那么这是我的登录:

session_start();
include  functions/functions.php ;  
$db = mysqlconnect();
$password = md5($_POST[ mypassword ]);
$mod = 1; 
$statement = $db->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$statement->execute(array($_POST[ myusername ],$password));
$result = $statement->fetchObject()->mod;
$count = $statement->rowCount();
if ( $result == 1 ) {
    $db = mysqlconnect();
    // Register $myusername, $mypassword and redirect to file "login_success.php"
    $_SESSION[ user ] = $_POST[ myusername ] ;
    //Test if it is a shared client
    if ( !empty($_SERVER[ HTTP_CLIENT_IP ]) ) {
        $ip=$_SERVER[ HTTP_CLIENT_IP ];
        //Is it a proxy address
    } elseif ( !empty($_SERVER[ HTTP_X_FORWARDED_FOR ]) ) {
        $ip=$_SERVER[ HTTP_X_FORWARDED_FOR ];
    } else {
        $ip=$_SERVER[ REMOTE_ADDR ];
    }
    $sqll = "UPDATE users SET lastip=? WHERE username=?";
    $q = $db->prepare($sqll);
    $q->execute(array($ip,$_SESSION[ username ]));
    $_SESSION[ user ] = $_POST[ myusername ] ;
    $sqlll = "INSERT INTO user_log (username,ip) VALUES (?, ?)";
    $qq = $db->prepare($sqlll);
    $qq->execute(array($_SESSION[ username ],$ip));
    header("Location: home.php");
} else {
    echo "Wrong Username or Password";
}

密码能注射吗?

这是我家的.php页面阻止用户观看它。

/// My conenct is here                    
$sql = "SELECT * FROM users WHERE username= $_SESSION[user] ";
$result = mysql_query($sql) or die(mysql_error());
$values = mysql_fetch_array($result);


if( isset($_SESSION[ user ]) ) {

} else {
    echo "Bye Bye";
    die;
}

if ( $values[ mod ] == 1 ) {    
    echo "welcome";  
} else {
    echo"Your account has been reported for hacking";
    die;
}

Answer 1

Assuming the queries you show are the only queries you use, it s funny how the hacker uses the very code you thought would block him. Very often in the IT world the front door is triple locked but the backdoor is open. In this case it s not the backdoor, but the little window in the door that you use to see if you are not opening to a crook.

使用已准备好的发言稿和对所有查询有约束力的变量。

这是一般规则你只是忘记了"所有查询"中的"所有"

您的声明 :

$sql = "SELECT * FROM users WHERE username= $_SESSION[user] ";

is your open window. Quite obviously your hacker spoofed the username in the session data. The simple solution is to:

validate the username or any data you receive from outside ($_SESSION, $_POST, some $_SERVER and others) BEFORE you do anything with it. Certainly before you perform any database interaction.
use variable binding like you did in the other queries.

在此情况下删除标签或使用 Mysql_ real_escape_string 的价值较低, 因为黑客完全有可能没有无法存储的字符。

顺便说一句,您并不真的需要使用 PDO 来使用变量绑定。这在 Mysql 中也是完全可能的。

$verbLok = mysqli_connect(Iam, not, gonna, tellyou);
$result = array();
if (($stmtLok = $verbLok->prepare( "SELECT * FROM users WHERE username = ?  limit 1")))
{        
    $stmtLok->bind_param("s", $_SESSION[user]);
    $stmtLok->execute();
    $result = $stmtLok->get_result();
    $stmtLok->close();
}
mysqli_close($verbLok);

$present 将保留一系列结果行。我不再熟悉常规查询, 但据我所知它与您的代码相似。

有关您查询中 SQL 密码注射攻击的可能性的有趣读物,请查阅在本页。

Answer 2

良好的 SQL 注射预防是避开可用于终止 SQL 命令的中度评价以启动新命令的任何和所有文字。

要做到这一点,您应该避开输入中的任何引号, 并使用更好的 SQL —— 使用字段和表格名称周围的回ickticks, 使用引号来包扎任何非代码文本等。

SELECT * FROM `users` WHERE `id` =  1

然后以 mysql_real_escape_string 或以# 039 等手动替换来解开所有引号, 还可以避免任何 HTML, 以确保它不会弄乱其它东西, 使用 htmlities 等。

友情链接