CARVIEW |
Select Language
HTTP/2 200
date: Thu, 31 Jul 2025 00:01:43 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
etag: W/"7660e7018ab60b18024af6f9f9a30d1e"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=WT12lHUbTFGuxod3argild8yNrENbixGctDNnI1G3hR%2B5ZDA%2FxoKvBOBTqUaecY7TFEgFlCvDY9ME3dpgjcMdiyw6JI1qYxCrRYKAtB5Ai1tMo%2B67KE1AzlISLOAhNITuWW18cA%2B3xjzxTnu22lEdTtndYMySnza3twyUf343WDD%2FO1HjhF7b5HHREpVgiEyVPGB2FRixJ8YtD%2BXiijTWlqWKoD5YhDqJ%2BhmnRJe3l3laUP0QCxnjAZGKytvWhEdIHWhf7TmPRr4lWQU5iZh6g%3D%3D--TO6wAEKxel%2FlwoPK--oZFGKzfhCSHis3a%2FrdujxQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1125649283.1753920103; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 00:01:43 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 00:01:43 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: 8944:2198DD:D9C21:1490B8:688AB267
SQL Inject · JoyChou93/java-sec-code Wiki · GitHub
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 697
SQL Inject
JoyChou edited this page Jul 17, 2019
·
2 revisions
访问https://localhost:8080/sqli/jdbc?username=joychou' or 'a'='a
返回joychou: 123 wilson: 456 lightless: 789
。
正常访问https://localhost:8080/sqli/jdbc?username=joychou
返回joychou: 123
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for users
-- ----------------------------
DROP TABLE IF EXISTS `users`;
CREATE TABLE `users` (
`username` varchar(255) NOT NULL,
`password` varchar(255) NOT NULL,
`isAdmin` varchar(255) NOT NULL,
`id` int(10) NOT NULL AUTO_INCREMENT,
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
-- ----------------------------
-- Records of users
-- ----------------------------
BEGIN;
INSERT INTO `users` VALUES ('joychou', '123', '1', 1);
INSERT INTO `users` VALUES ('wilson', '456', '0', 2);
INSERT INTO `users` VALUES ('lightless', '789', '0', 3);
COMMIT;
SET FOREIGN_KEY_CHECKS = 1;
SQL注入修复方式采用预处理方式,修复见代码。
预处理的修复原理:针对字符串类型的SQL注入,是在字符串两边加上一对单号哈''
,对于中间点的单引号对其进行转义\'
,让其变成字符的单引号。Mybatis的#{}
也是预处理方式处理SQL注入。
在使用了mybatis框架后,需要进行排序功能时,在mapper.xml文件中编写SQL语句时,注意orderBy后的变量要使用${}
,而不用#{}
。因为#{}
变量是经过预编译的,${}
没有经过预编译。虽然${}
存在SQL注入的风险,但orderBy必须使用${}
,因为#{}
会多出单引号''
导致SQL语句失效。为防止SQL注入只能自己对其过滤。
根据下面的结果可以发现order by 'username'
并没有用,第一条SQL和第二条SQL效果一样。
select * from users order by 'username' desc -- 结果为 joychou wilson lightless
select * from users -- 结果为 joychou wilson lightless
select * from users order by username -- 结果为 joychou lightless wilson
select * from users order by username desc -- 结果为 wilson lightless joychou
Clone this wiki locally
You can’t perform that action at this time.