那些年我们一起挖掘SQL注入 - 5.全局防护Bypass之宽字节注入

<?php
function connect($dbhost, $dbuser, $dbpw, $dbname = ‘‘, $dbcharset = ‘gbk‘, $connect = 1)
{
    $func = empty($connect) ? ‘mysql_pconnect‘ : ‘mysql_connect‘;
    if (!$this->linkid = @$func($dbhost, $dbuser, $dbpw, true)) {
        $this->dbshow(‘Can not connect to Mysql!‘);
    } else {
        if ($this->dbversion() > ‘4.1‘) {
            mysql_query("SET NAMES gbk");
            if ($this->dbversion() > ‘5.0.1‘) {
                mysql_query("SET sql_mode = ‘‘", $this->linkid);
                //character_set_client=binary即二进制方式
                mysql_query("SET character_set_connection=" . $dbcharset . ", character_set_results=" . $dbcharset . ", character_set_client=binary", $this->linkid);
            }
        }
    }
...
}
?>

elseif($act == ‘do_reg‘)
{
    $captcha = get_cache(‘captcha‘);
    if ($captcha[‘verify_userreg‘] == "1") {
        $postcaptcha = $_POST[‘postcaptcha‘];
        if ($captcha[‘captcha_lang‘] == "cn" && strcasecmp(QISHI_DBCHARSET, "utf8") != 0) {
            $postcaptcha = iconv("utf-8", QISHI_DBCHARSET, $postcaptcha);
        }
        if (empty($postcaptcha) || empty($_SESSION[‘imageCaptcha_content‘]) || strcasecmp($_SESSION[‘imageCaptcha_content‘], $postcaptcha) != 0) {
            exit("err");
        }
    }
    require_once(QISHI_ROOT_PATH . ‘include/fun_user.php‘);
    $username = isset($_POST[‘username‘]) ? trim($_POST[‘username‘]) : exit("err");
    $password = isset($_POST[‘password‘]) ? trim($_POST[‘password‘]) : exit("err");
    $member_type = isset($_POST[‘member_type‘]) ? intval($_POST[‘member_type‘]) : exit("err");
    $email = isset($_POST[‘email‘]) ? trim($_POST[‘email‘]) : exit("err");
    if (strcasecmp(QISHI_DBCHARSET, "utf8") != 0) {
        //对注册的名字进行utf-8到GBK的编码转换
        $username = iconv("utf-8", QISHI_DBCHARSET, $username);
        $password = iconv("utf-8", QISHI_DBCHARSET, $password);
    }
    $register = user_register($username, $password, $member_type, $email);

//检查简历的完成程度
//注册会员
function user_register($username,$password,$member_type=0,$email,$uc_reg=true)
{
    global $db,$timestamp,$_CFG,$online_ip,$QS_pwdhash;
    $member_type=intval($member_type);
    //这里是用get_user_inusername函数来判断用户名是否已经存在，我们跟进
    $ck_username=get_user_inusername($username);
    $ck_email=get_user_inemail($email);
    ... ...
    return $insert_id;
}

function get_user_inusername($username)
{
    global $db;
    //带入查询，可注入～
    $sql = "select * from ".table(‘members‘)." where username = ‘{$username}‘ LIMIT 1";
}

elseif($act == ‘key‘)
{
    $key = trim($_GET[‘key‘]);
    if (!empty($key)) {
        if (strcasecmp(QISHI_DBCHARSET, "utf8") != 0)
            //对参数key进行utf-8到GBK编码的转换
            $key = iconv("utf-8", QISHI_DBCHARSET, $key);
        //带入查询，可以注入
        $result = $db->query("select * from " . table(‘category‘) . " where c_alias=‘QS_street‘ AND c_name LIKE ‘%{$key}%‘ ");
        //将查询结果输出到页面中，可回显
        while ($row = $db->fetch_array($result)) {
            if ($listtype == "li") {
                $htm .= "<li  title=\"{$row[‘c_name‘]}\" id=\"{$row[‘c_id‘]}\">{$row[‘c_name‘]}</li>";
            } else {
                $_GET[‘streetid‘] = $row[‘c_id‘];
                $url = url_rewrite(‘QS_street‘, $_GET);
                $htm .= "<li><a href=\"{$url}\" title=\"{$row[‘c_note‘]}\" class=\"vtip\">{$row[‘c_name‘]}</a><span>{$row[‘stat_jobs‘]}</span></li>";
            };
        }
        if (empty($htm)) {
            $htm = "<span class=\"noinfo\">没有找到关键字： <span>{$key}</span> 相关道路！</span>";
        }
        exit($htm);
    }
}