通过 addlashes() 进行 SQL 注入的示例?
在 PHP 中，我知道 mysql_real_escape 比使用 addslashes 安全得多.但是，我找不到 addslashes 会导致 SQL 注入发生的示例.
In PHP, I know that mysql_real_escape is much safer than using addslashes.
However, I could not find an example of a situation where addslashes would let an SQL Injection happen.
谁能举几个例子?
推荐答案
嗯，这是你想要的文章.
基本上，攻击的工作方式是让 addslashes() 将反斜杠放在多字节字符的中间，这样反斜杠就会因为成为有效多字节序列的一部分而失去意义.
Basically, the way the attack works is by getting addslashes() to put a backslash in the middle of a multibyte character such that the backslash loses its meaning by being part of a valid multibyte sequence.
文章中的一般警告:
这种类型的攻击对于任何字符编码都是可能的有一个以 0x5c 结尾的有效多字节字符，因为addslashes() 可以被欺骗来创建一个有效的多字节字符而不是转义后面的单引号.UTF-8 不适合这个描述.
This type of attack is possible with any character encoding where there is a valid multi-byte character that ends in
0x5c, becauseaddslashes()can be tricked into creating a valid multi-byte character instead of escaping the single quote that follows. UTF-8 does not fit this description.
相关文章