|
 |
| |
ขอความช่วยเหลือเขียน class ตรวจสอบ SQL ต้องทำอย่างไรบ้างถึงจะได้ผลลัพธ์ |
| |
 |
|
|
 |
 |
|
ต้องการเขียน class ในหน้า check_sql.php
โดยนำ $strSQL1 และ $strSQL จากข้างล่างไปตรวจสอบในหน้า check_sql.php ที่มี
Code (PHP)
function check_sqlinjection()
{
$key_arr = array("SELECT","FROM","WHERE","OR","ORDER BY","GROUP BY","AND","DROP","CREATE","TABLE","LIKE","UNION","HAVING","CONVERT,INT,WAITFORDELAY","@@ VERSION,@@SERNAME","SELECT ALL","NULL","LEN","ASCII","SUBSTRING","@@DATADIR","DATABASE","USER()", "EXECUTE","@RESULT","EXECMASTER","#","?","|","^","*","<","'","\"","=",";",">",">=","<=","<>","DISTINCT","NOT","IN","BETWEEN","AVG", "COUNT","COUNT(*)","MIN","MAX","SUM","+","-","/","DELETE","INSERT","LIMIT","--","JOIN","EXISTS","CHAR","VARCHAR","BIT", "TIME","DECIMAL","NUMERIC","DATE","&","0X","LOWER","UPPER","VERSION" ,"CURRENT_DATABASE","OFFSET","RLIKE","CONCAT");
}
ใช้ตรวจสอบ $strSQL1 มีคำสั่งจำนวนกี่ค่าแต่ละค่ามีจำนวนเท่าไร และ $strSQL มีคำสั่งจำนวนกี่ค่าแต่ละค่ามีจำนวนเท่าไร
ถ้าเท่ากันให้ execute $strSQL ที่ $objQuery = mysql_query($strSQL) or die ("Error Query [".$strSQL."]");
ถ้าค่าไม่เท่ากันให้บันทึกลงตราง badsql
ทำอย่างไร ช่วยชี้แนะให้ที
Code
<html>
<head>
<title></title>
</head>
<body>
<form name="frmSearch" method="get" action="<?=$_SERVER['SCRIPT_NAME'];?>">
<table width="599" border="1">
<tr>
<th>Keyword
<input name="txtKeyword" type="text" id="txtKeyword">
<input type="submit" value="Search"></th>
</tr>
</table>
</form>
<?php
include("check_sql.php");
if(isset($_GET["txtKeyword"]))
{
$_GET!= "";
$objConnect = mysql_connect("localhost","admin","123456") or die("Error Connect to Database");
$objDB = mysql_select_db("mydatabase");
// after
$strSQL = "SELECT * FROM member WHERE (Username LIKE '%".$_GET["txtKeyword"]."%' or Name LIKE '%".$_GET["txtKeyword"]."%' ) ";
//before
$strSQL1 = "SELECT * FROM member WHERE (Username LIKE '%".$_GET[""]."%' or Name LIKE '%".$_GET[""]."%' ) ";
$objQuery = mysql_query($strSQL) or die ("Error Query [".$strSQL."]");
?>
<table width="600" border="1">
<tr>
<th width="91"> <div align="center">UserID </div></th>
<th width="98"> <div align="center">Username </div></th>
<th width="198"> <div align="center">Name </div></th>
</tr>
<?php
while($objResult = mysql_fetch_array($objQuery))
{
?>
<tr>
<td><div align="center"><?=$objResult["UserID"];?></div></td>
<td><?=$objResult["Username"];?></td>
<td><?=$objResult["Name"];?></td>
/////
<table cellspacing="1" cellpadding="5" style="background-color:#666;">
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">old query sql</td>
<td><?php echo $valid->query_old?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">new query sql</td>
<td><?php echo $valid->query_new; ?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">count old query sql</td>
<td><?php
foreach($valid->key_count_old as $value){ echo $value."<br>";}
?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">count new query sql</td>
<td><?php
foreach($valid->key_count_new as $value){ echo $value."<br>";}
?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">hash old check</td>
<td><?php
echo("HAS(");
$i = 0;
foreach($valid->key_old as $value){ if($i > 0 && $i < count($valid->key_new)){ echo ",";} echo $value; $i++;}
echo(")");
?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">hash new check</td>
<td><?php
echo("HAS(");
$i = 0;
foreach($valid->key_new as $value){ if($i > 0 && $i < count($valid->key_new)){ echo ",";} echo $value; $i++;}
echo(")");
?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">time hash old check(ms)</td>
<td><?php echo $valid->time_has_old; ?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">time hash new check(ms)</td>
<td><?php echo $valid->time_has_new; ?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">time compare hash old and new check(ms)</td>
<td></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">count old query sql has single qoute</td>
<td><?php echo $valid->count_single_qoute_old; ?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">count new query sql has single qoute</td>
<td><?php echo $valid->count_single_qoute_new;?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">time count old query sql has single qoute(ms)</td>
<td><?php echo $valid->time_count_single_qoute1;?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">time count new query sql has single qoute(ms)</td>
<td><?php echo $valid->time_count_single_qoute2;?></td>
</tr>
<tr style="background-color:#FFF;">
<td style="vertical-align:top;text-align:right;">Log not matching</td>
<td><?php echo $valid->not_macth_query;?></td>
</tr>
</table>
///
</tr>
<?php
}
?>
</table>
<?php
mysql_close($objConnect);
}
?>
</body>
</html>
Tag : PHP, HTML/CSS, JavaScript, VBScript, Action Script
|
|
|
 |
 |
 |
 |
| Date :
2014-03-20 16:56:35 |
By :
mininovaa |
View :
759 |
Reply :
7 |
|
 |
 |
 |
 |
|
|
|
|
 |
 |
|
 |
 |
| |
|
|
|
| |
|
ไม่ค่อยเข้าใจ ...ทำไปเพื่อ? 
|
| |
|
|
| |
| Date :
2014-03-20 19:11:19 |
By :
randOmizE |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
ส่งอาจารย์ ให้มันดูยาก จะได้คะแนนดีดี ?? 
|
| |
|
|
| |
| Date :
2014-03-20 21:42:36 |
By :
apisitp |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
เป็นงานที่ยากน่าดูครับ 
|
| |
|
|
| |
| Date :
2014-03-20 21:48:12 |
By :
{Cyberman} |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
การบ้านหรือว่าใช้งานจริง จุดประสงค์คือกำลังจะทำอะไร
|
| |
|
|
| |
| Date :
2014-03-20 21:56:33 |
By :
PlaKriM |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
สงสัยให้นับพวก reserved words / function / operator ... และอื่นๆ ที่ไม่ใช่ user defined ละมั้ง
|
| |
|
|
| |
| Date :
2014-03-20 22:47:07 |
By :
sakuraei |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
อ่อ
ถ้างั้นก็ substr_count ดื้อๆ เลย
อ้อ อย่าลืมเอาพวก reserved word ที่ escape แล้วออกก่อนนับนะ
|
| |
|
|
| |
| Date :
2014-03-20 22:52:15 |
By :
itpcc |
|
|
| |
|
|
|
|
|
| |
|
|
|
|
|
| |
|
 Load balance : Server 00
|
Quote:
