We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
String sql = "select * from user_table where username= ' "+userName+" ' and password=' "+password+" '"; --当输入了上面的用户名和密码,上面的SQL语句变成: SELECT * FROM user_table WHERE username= '’or 1 = 1 -- and password='’ --分析SQL语句: --条件后面username=”or 1=1 用户名等于 ” 或1=1 那么这个条件一定会成功; --然后后面加两个-,这意味着注释,它将后面的语句注释,让他们不起作用,这样语句永远都--能正确执行,用户轻易骗过系统,获取合法身份。 --这还是比较温柔的,如果是执行 SELECT * FROM user_table WHERE username='' ;DROP DATABASE (DB Name) --' and password=''
The text was updated successfully, but these errors were encountered:
No branches or pull requests
The text was updated successfully, but these errors were encountered: