{"id":703,"date":"2012-11-05T10:00:51","date_gmt":"2012-11-05T09:00:51","guid":{"rendered":"https:\/\/d-mueller.de\/blog\/?p=703"},"modified":"2016-01-11T22:41:04","modified_gmt":"2016-01-11T21:41:04","slug":"mysql-injection-mal-anders","status":"publish","type":"post","link":"https:\/\/d-mueller.de\/blog\/mysql-injection-mal-anders\/","title":{"rendered":"MySQL-Injection mal anders"},"content":{"rendered":"<p>Man nehme folgenden Script-Aufbau:<\/p>\n<pre data-enlighter-language=\"php\" class=\"EnlighterJSRAW\">\r\n&lt;?php\r\n$mysqli = new mysqli(&#039;localhost&#039;, &#039;root&#039;, &#039;&#039;, &#039;datatabletest&#039;);\r\n$rating = $mysqli-&gt;real_escape_string($_GET[&#039;rating&#039;]);\r\n$sql = &quot;SELECT name, rating FROM movies WHERE rating &gt; &quot; . $rating;\r\n<\/pre>\n<p>Da wir ja musterg\u00fcltig escapen, sollte eigentlich nichts schief gehen &#8211; oder? Nun, der Benutzer \u00fcbermittelt in <i>$_GET[&#8218;rating&#8216;]<\/i> folgenden Wert:<\/p>\n<pre data-enlighter-language=\"enlighter\" class=\"EnlighterJSRAW\">\r\n3 AND 0 = IF(1, BENCHMARK(1000000, MD5(REPEAT(CONVERT(1, CHAR), 1000))), 0)\r\n<\/pre>\n<p>Der Wert von $sql lautet danach:<\/p>\n<pre data-enlighter-language=\"sql\" class=\"EnlighterJSRAW\">\r\nSELECT name, rating FROM movies WHERE rating &gt; 3 AND 0 = IF(1, BENCHMARK(1000000, MD5(REPEAT(CONVERT(1, CHAR), 1000))), 0)\r\n<\/pre>\n<p>Ein astreines DoS-Einfallstor. In solchen F\u00e4llen besser intval verwenden. <\/p>\n<p><a href=\"http:\/\/blog.ulf-wendel.de\/2012\/not-only-sql-injection-i-dont-trust-you\/\">Original entdeckt von ulf-wendel.de<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Man nehme folgenden Script-Aufbau: &lt;?php $mysqli = new mysqli(&#039;localhost&#039;, &#039;root&#039;, &#039;&#039;, &#039;datatabletest&#039;); $rating = $mysqli-&gt;real_escape_string($_GET[&#039;rating&#039;]); $sql = &quot;SELECT name, rating FROM movies WHERE rating &gt; &quot; . $rating; Da wir ja musterg\u00fcltig escapen, sollte eigentlich nichts schief gehen &#8211; oder? &hellip; <a href=\"https:\/\/d-mueller.de\/blog\/mysql-injection-mal-anders\/\">Weiterlesen <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,6,3],"tags":[],"class_list":["post-703","post","type-post","status-publish","format-standard","hentry","category-datenbanken","category-security","category-webdev"],"_links":{"self":[{"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/posts\/703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/comments?post=703"}],"version-history":[{"count":0,"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/posts\/703\/revisions"}],"wp:attachment":[{"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/media?parent=703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/categories?post=703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/d-mueller.de\/blog\/wp-json\/wp\/v2\/tags?post=703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}