環境配置：mysql下
create database demo;
use demo;
create table user(username varchar(100),password varchar(100));
create table user(username varchar(100),password varchar(100));
insert into user values("test","test");
send.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<form action="hack.jsp" method="post">
<ul>
<li>模擬sql注入攻擊</li>
<li>用戶名 <input type="text" name="username" /></li>
<li>密碼 <input type="password" name="password" /></li>
<li><input type="submit" value="提交" /> <input type="reset"
value="重置" /></li>
</ul>
</body>
</html>
hack.jsp
<%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<%
String username=request.getParameter("username");
String password=request.getParameter("password");
try {
Class.forName("com.mysql.jdbc.Driver");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456");
Statement statement=connection.createStatement();
ResultSet resultSet=statement.executeQuery("select * from user where username='"+username+"'and password='"+password+"'");
if(resultSet.next())
{
out.print("<p>用戶名:"+resultSet.getString(1)+" 密碼"+resultSet.getString(2)+"</p></br>");
out.print("登陸成功");
}
else
out.print("用戶名或密碼錯誤");
%>
</body>
</html>
攻擊方式
用戶名或密碼輸入：
'or 1=1 or'
即可登陸成功。提示信息：
用戶名:test 密碼test
登陸成功
優化方法
使用PreparedStatement來避免SQL攻擊，如下，問題解決。
<%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<%
String username=request.getParameter("username");
String password=request.getParameter("password");
try {
Class.forName("com.mysql.jdbc.Driver");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456");
PreparedStatement preparedStatement=connection.prepareStatement("select * from user where username=? and password=?");
preparedStatement.setString(1, username);
preparedStatement.setString(2, password);
ResultSet resultSet=preparedStatement.executeQuery();
if(resultSet.next())
{
out.print("<p>用戶名:"+resultSet.getString(1)+" 密碼"+resultSet.getString(2)+"</p></br>");
out.print("登陸成功");
}
else
out.print("用戶名或密碼錯誤");
%>
</body>
</html>
send.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<form action="hack.jsp" method="post">
<ul>
<li>模擬sql注入攻擊</li>
<li>用戶名 <input type="text" name="username" /></li>
<li>密碼 <input type="password" name="password" /></li>
<li><input type="submit" value="提交" /> <input type="reset"
value="重置" /></li>
</ul>
</body>
</html>
hack.jsp
<%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<%
String username=request.getParameter("username");
String password=request.getParameter("password");
try {
Class.forName("com.mysql.jdbc.Driver");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456");
Statement statement=connection.createStatement();
ResultSet resultSet=statement.executeQuery("select * from user where username='"+username+"'and password='"+password+"'");
if(resultSet.next())
{
out.print("<p>用戶名:"+resultSet.getString(1)+" 密碼"+resultSet.getString(2)+"</p></br>");
out.print("登陸成功");
}
else
out.print("用戶名或密碼錯誤");
%>
</body>
</html>
攻擊方式
用戶名或密碼輸入：
'or 1=1 or'
即可登陸成功。提示信息：
用戶名:test 密碼test
登陸成功
優化方法
使用PreparedStatement來避免SQL攻擊，如下，問題解決。
<%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<%
String username=request.getParameter("username");
String password=request.getParameter("password");
try {
Class.forName("com.mysql.jdbc.Driver");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456");
PreparedStatement preparedStatement=connection.prepareStatement("select * from user where username=? and password=?");
preparedStatement.setString(1, username);
preparedStatement.setString(2, password);
ResultSet resultSet=preparedStatement.executeQuery();
if(resultSet.next())
{
out.print("<p>用戶名:"+resultSet.getString(1)+" 密碼"+resultSet.getString(2)+"</p></br>");
out.print("登陸成功");
}
else
out.print("用戶名或密碼錯誤");
%>
</body>
</html>
