这是一个创建于 2550 天前的主题，其中的信息可能已经有所发展或是发生改变。
昨天测试一个网站登录框 user=admin'='admin'-- &passwd=admin 绕过验证了。本地尝试时对连等的行为有点不理解
mysql> select * from users; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 1 | admin | admin | | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 3 rows in set (0.00 sec) mysql> select * from users where username='admin'='admin'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 2 rows in set, 1 warning (0.00 sec) mysql> select * from users where username='admin'='guest'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 2 rows in set, 1 warning (0.00 sec) mysql> select * from users where username='admin'='a'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 2 rows in set, 1 warning (0.00 sec) mysql> select * from users where username='admin'='1'; +----+----------+----------+ | id | username | password | +----+----------+----------+ | 1 | admin | admin | +----+----------+----------+ 1 row in set (0.00 sec) mysql> select * from users where username='admin'='2'; Empty set (0.00 sec) 这里的解析逻辑是怎样的？
 | 1 lichao 2018-10-22 12:25:18 +08:00 被 SQL 注入了 |
 | 3 jzmws 2018-10-22 12:43:06 +08:00 via Android 防止 sql 注入最基本的防护 |
 | 4 whoami9894 OP |
| 5 lichao 2018-10-22 13:29:00 +08:00 @whoami9894 做安全的怎么会不知道 -- 后面是注释 |
| 6 lichao 2018-10-22 13:31:00 +08:00 @whoami9894 哦，那明白你意思了 |
 | 7 loading 2018-10-22 13:35:39 +08:00 via Android 拼接字符串，实际拼进去就知道了。 |
| 8 lichao 2018-10-22 13:45:39 +08:00 select * from users where name = 0; 这个出来的结果也很奇怪，MySQL 好奇怪 |
| 9 lichao 2018-10-22 13:48:35 +08:00 PostgreSQL 这种语句就完全不合法 |
 | 10 zjsxwc 2018-10-22 13:50:12 +08:00 mysql 本来就能连等： mysql> select (2=2=2); +---------+ | (2=2=2) | +---------+ | 0 | +---------+ 1 row in set (0.00 sec) mysql> select (2=2=true); +------------+ | (2=2=true) | +------------+ | 1 | +------------+ 1 row in set (0.00 sec) mysql> select (2=2=1); +---------+ | (2=2=1) | +---------+ | 1 | +---------+ 1 row in set (0.00 sec) |
 | 12 jjwjiang 2018-10-22 13:56:47 +08:00 跟 JS 语法类似，连等先判断头两个，变成了 true 或者 false |
 | 13 kev17 2018-10-22 13:57:46 +08:00  1 (user= "a" ) = "b" 会选出最终结果为 true 的行 例如 ``` mysql> select * from users where username='admin'='admin'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 2 rows in set, 1 warning (0.00 sec) ``` 结果 （ 1 ） 第一步 username='admin'的记录返回 1，第二步 true = 'admin' 返回 0，这种记录不会被选择出来 （ 2 ） 第一步 username <> 'admin'的记录返回 0，第二步 false = 'admin' 返回 1，这种记录会被选择出来 |
 | 14 frazy 2018-10-22 14:11:05 +08:00 楼上正解~ 1 就是 true，其他都是 false |
| 15 whoami9894 OP @kev17 ```sql mysql> select * from users where false='admin'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 1 | admin | admin | | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 3 rows in set, 1 warning (0.05 sec) mysql> select * from users where true='admin'; Empty set, 1 warning (0.00 sec) ``` SQL 在 bool 和 str 之间比较的行为好奇怪，0='admin'返回 true 这样的话就解释通了 |
 | 16 tsparrot 2020-04-25 11:21:41 +08:00 mysql> select * from users; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 1 | admin | admin | | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 3 rows in set (0.00 sec) mysql> select * from users where username='admin'='admin'; +----+-----------+----------+ | id | username | password | +----+-----------+----------+ | 3 | guest | abcdefg | | 2 | anonymous | 123456 | +----+-----------+----------+ 2 rows in set, 1 warning (0.00 sec) 楼主你好，请问你帖子里的这个查询返回的结果里为什么会有数据呢（ username='admin'返回 1，而 where 1 = ‘str’不是相当于 where 0 吗 为什么会返回数据呢 |
| 17 whoami9894 OP @tsparrot 'guest'='admin'='admin' => ('guest'='admin')='admin' 'guest'='admin' => 0 0='admin' => 1 所以查出所有 username != 'admin'的记录 |
| 18 tsparrot 2020-04-28 19:39:00 +08:00 @whoami9894 哦哦明白了，谢谢楼主 |
Select Language