SQL注入过滤字符的Fuzz脚本测试
Get.php
<!DOCTYPE html>
<html>
<head>
<title>Sql Waf Test</title>
</head>
<body>
<div style="text-align:center;">
<form method="GET" action="">
<h1>Insert Data</h1>
<input type="text" name="username" style="height:25px;width:250px;" placeholder="Please input your username">
<br><br>
<input type="password" name="password" style="height:25px;width:250px;" placeholder="Please input your password">
<br><br>
<input type="submit" name="submit1" style="height:31px;color:#7d7d7d;" value="sbumit">
$black_list="/select|sleep|and|or|union|\"|'|--|#|where|from|limit/i";
$con = mysqli_connect("127.0.0.1:3306","root","root");
mysqli_query($con,"create database test");
mysqli_select_db($con,"test");
mysqli_query($con,"create table tb_user
(
uid int(11) primary key auto_increment not null,
username varchar(50) not null,
password varchar(50) not null,
UNIQUE(username)
)");
if(isset($_GET['submit1'])){
$username = $_GET['username'];
$password = md5($_GET['password']);
if(preg_match($black_list,$username)){
echo "Illegal Char";
}else{
if(empty($username) || empty($password)){
echo "Username or Password can not be empty
";
}else{
$insert_sql = mysqli_query($con,"insert into tb_user value(0,'
$username','$password')");
if($insert_sql){
echo "Insert Success
";
}else{
echo "Insert Fail
";
}
}
}
}
?>