我将如何区分我的sql基准功能,从而不会受到盲人注射攻击,例如“如果(用户)如根基-%,基准(100000,sha1(测试))”;”
* 选自func,没有显示功能基准。
Kind Regards Charles
我找到了答案!
....
echo preg_match("/^([ )"a-zA-Z0-9])+([0-255[:ascii:]])+select+([0-255[:ascii:]])+([-])+([0-255[:ascii:]])+$/","8 union select 1 from --");
echo preg_match("/^([ )"(a-zA-Z0-9])+([0-255[:ascii:]])+benchmark+([0-255[:ascii:]])+([-])+([0-255[:ascii:]])+$/","select if( user() like root@% , benchmark(100000,sha1( test )), false )--");
....
@Charles 我同意,在不首先处理根源(投入验证等)的情况下,消除BAENCHMARK功能,正在把hor放在车前。 但我不同意这样的说法,即它完全是 fence的,或者毫无用处。
假设:(a) 它相对容易失控,(b) 拆解它不会造成新的脆弱性,为什么不这样做? 对我来说,这并不是第二项防御措施,而是确保该制度的第一步:拆除任何和所有服务和设施;不使用职能。 否则,你只是用另一个潜在工具——更不用说一种工具——将攻击者的工具箱装入每一个推进剂—— 黑人 Box!
我认为,我对你的论点提出的最大问题不是因为关于能否使BENCHMARK失去能力的辩论,而是因为你认为对称的疑问是站不住脚的。 把太多的信仰引入一个体系,并具有虚假的安全感,比不破坏像BENCHMARK这样的特征更为危险。 谁说,Oracle/Microsoft/etc.在未来的释放中不引入ug? 谁会说,现在就在等待发现的时候,这只字塔吗? 谁能说你们能够信任每一个从事守则工作的人?
I noticed that there were some threads with similar questions, and I did look through them but did not really get a convincing answer. Here s my question: The subquery below returns a Table with 3 ...
<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...
我把我的用心从使用QQL转向MySQL。 它与凯科特合作,现在不工作,因为我已经改变,使用MySQL。 这里的错误信息是:
We have a restaurant table that has lat-long data for each row. We need to write a query that performs a search to find all restaurants within the provided radius e.g. 1 mile, 5 miles etc. We have ...
Is it possible in php to return a specific row of data from a mysql query? None of the fetch statements that I ve found return a 2 dimensional array to access specific rows. I want to be able to ...
Our website was developed with a meta tag set to... <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> This works fine for M-dashes and special quotes, etc. However, I ...
What are some of the strategies being used for pagination of data sets that involve complex queries? count(*) takes ~1.5 sec so we don t want to hit the DB for every page view. Currently there are ~...
My table looks like person_id | car_id | miles ------------------------------ 1 | 1 | 100 1 | 2 | 200 2 | 3 | 1000 2 | 4 | 500 I need to ...