SQL注入之Sqli-labs系列第四十六关(ORDER BY注入）

0X1查看页面

0x2源码

<?php
include("../sql-connections/sql-connect.php");
$id=$_GET['sort'];    
if(isset($id))
    {
    //logging the connection parameters to a file for analysis.
    $fp=fopen('result.txt','a');
    fwrite($fp,'SORT:'.$id."\n");
    fclose($fp);

    $sql = "SELECT * FROM users ORDER BY $id";
    echo $sql . '<br>';
    $result = mysql_query($sql);
    if ($result)
        {
        ?>
        <center>
        <font color= "#00FF00" size="4">
        
        <table   border=1'>
        <tr>
            <th>&nbsp;ID&nbsp;</th>
            <th>&nbsp;USERNAME&nbsp;  </th>
            <th>&nbsp;PASSWORD&nbsp;  </th>
        </tr>
        </font>
        </font>
        <?php
        while ($row = mysql_fetch_assoc($result))
            {
            echo '<font color= "#00FF11" size="3">';        
            echo "<tr>";
                echo "<td>".$row['id']."</td>";
                echo "<td>".$row['username']."</td>";
                echo "<td>".$row['password']."</td>";
            echo "</tr>";
            echo "</font>";
            }    
        echo "</table>";
        
        }
        else
        {
        echo '<font color= "#FFFF00">';
        print_r(mysql_error());
        echo "</font>";  
        }
    }    
    else
    {
        echo "Please input parameter as SORT with numeric value<br><br><br><br>";
        echo "<br><br><br>";
        echo '<img src="../images/Less-46.jpg" /><br>';
        echo "Lesson Concept and code Idea by <b>D4rk</b>";
    }
?>

php源码