萬能密碼的SQL注入漏洞其PHP環(huán)境搭建及防御手段

drop database if exists lab;
create database lab;
use lab;

create table users
(
    id int not null auto_increment,
    username char(32) not null,
    passcode char(32) not null,
    primary key(id)
);

insert into users(username,passcode) values('admin','admin123');
insert into users(username,passcode) values('alice','alice456');

html>

head>
    meta charset="UTF-8">
    title>Login/title>
    style>
        #a {
            width: 500px;
            text-align: center;
        }
        
        .b {
            width: 200px;
            height: 30px;
        }
    /style>
/head>

body>
    div id=a>
        h2>Login!/h2>
        form name="form_login" method="POST" action="check_login.php">
            Username:input type="text" class="b" name="username" />br> br> 
  Password:input type="password" class="b" name="password" />br>
            input type="submit" name="Submit" value="Submit" />
            input type="reset" name="reset" value="Reset" />
        /form>
    /div>
/body>

/html>

?php
include('con_database.php');

$username=isset($_POST['username'])?$_POST['username']:'';
$password=isset($_POST['password'])?$_POST['password']:'';
if($username=='' || $password==''){
    echo "script>alert('請(qǐng)輸入賬號(hào)和密碼！')/script>";
    exit;
}

$sql="select * from users where username='$username' and passcode='$password'";

$query=mysqli_query($con,$sql) or die('SQL語句執(zhí)行失敗'.mysqli_error($con));
if ($row=mysqli_fetch_array($query)){
    session_start();
    $_SESSION['username']=$row[1];
    echo "a href='welcome.php'>歡迎訪問/a>";
}else{
    echo "script>alert('登錄失??！');history.go(-1)/script>";
}
mysqli_close($con);
?>

?php
$con=mysqli_connect('127.0.0.1','root','root') or die("數(shù)據(jù)庫(kù)連接失敗！");
mysqli_select_db($con,'lab')or die("數(shù)據(jù)庫(kù)連接失敗");
?>

?php
session_start();
session_unset();
session_destroy();
echo "注銷成功";
?>

?php
session_start();
if(isset($_SESSION['username'])){
    echo "歡迎用戶".$_SESSION['username']."登錄";
    echo "br>";
    echo "a href=logout.php>退出登錄/a>";
}else{
    echo "您沒有權(quán)限訪問";
}
?>

?php
include('con_database.php');

$username=isset($_POST['username'])?$_POST['username']:'';
$password=isset($_POST['password'])?$_POST['password']:'';
if (!preg_match("/^[a-Z0-9A-Z_]{5,16}$/",$username)){
    echo "script>alert('用戶名格式錯(cuò)誤')/script>";
    exit;

if($username=='' || $password==''){
    echo "script>alert('請(qǐng)輸入賬號(hào)和密碼！')/script>";
    exit;
}

$sql="select * from users where username='$username' and passcode='$password'";

$query=mysqli_query($con,$sql) or die('SQL語句執(zhí)行失敗'.mysqli_error($con));
if ($row=mysqli_fetch_array($query)){
    session_start();
    $_SESSION['username']=$row[1];
    echo "a href='welcome.php'>歡迎訪問/a>";
}else{
    echo "script>alert('登錄失?。?);history.go(-1)/script>";
}
mysqli_close($con);
}
?>

$username=isset($_POST['username'])?addslashes($_POST['username']):'';
$password=isset($_POST['password'])?mysqli_real_escape_string($con,$_POST['password']):'';

?php
include('con_database.php');

$username=isset($_POST['username'])?$_POST['username']:'';
$password=isset($_POST['password'])?$_POST['password']:'';

if($username==''||$password==''){
    echo "script>alert('錯(cuò)誤！');history.go(-1);/script>";
    exit;
}
$sql="select * from users where username=? and passcode=? ;";//問號(hào)表示需要一個(gè)參數(shù)
$stmt=$con->prepare($sql);//預(yù)編譯SQL語句
if(!$stmt){
    echo 'prepare 執(zhí)行錯(cuò)誤';
}
else{
    $stmt->bind_param("ss",$username,$password); //為預(yù)編譯綁定SQL參數(shù)，ss表示兩個(gè)字符串
    //i——int d——double  s——string   b——boolean
    $stmt->execute();
    $result=$stmt->get_result();
    $row=$result->fetch_row();
    if($row){
        session_start();
        $_SESSION['username']=$row[1];
        echo $row[1]."a href='welcome.php'>歡迎訪問/a>";
    }else{
        echo "script>alert('登錄失敗??！');history.go(-1);/script>";
    }
    $stmt->close();
}
$con->close();
?>