0x00 背景介紹

萬(wàn)能密碼大伙都知道鸽素，類似于 admin' or '1'='1肪笋，至于為什么牡辽，我突然間糊涂了粒氧，糊涂的地方在于or和and兩個(gè)邏輯運(yùn)算符的優(yōu)先級(jí)越走。
　　下面來(lái)看一個(gè)例子，后臺(tái)數(shù)據(jù)庫(kù)語(yǔ)句很普通靠欢，如下：select * from user where username='$name' and passwd='$password';將username寫成admin' or '1'='1廊敌，passwd隨意寫成123，那么上面那條語(yǔ)句就變成了：select * from user where username='admin' or '1'='1' and passwd='123'门怪。
　　因?yàn)檫壿嬤\(yùn)算符的優(yōu)先級(jí)：NOT>AND>OR骡澈，所以上面語(yǔ)句的執(zhí)行過(guò)程如下： select * from user where username='admin' or 【 '1'='1' and passwd='123'】，方括號(hào)中間的內(nèi)容一般都是假的掷空，因?yàn)閜asswd是隨意寫的肋殴，一般都不對(duì)囤锉，所以也無(wú)外乎寫成'1'='1'還是'1'='2'，所以or后面的邏輯是【假】护锤，但是username='admin'是【真】官地，所以這條語(yǔ)句就相當(dāng)于：select * from user where username='admin'。
　　當(dāng)然烙懦，如果passwd字段如果正確了驱入，則會(huì)返回至少兩條數(shù)據(jù)÷任觯【大前提】username中有admin亏较。

0x01 AND OR 實(shí)驗(yàn)

mysql> select * from pet;
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
| bell  |    2 |
| sunny |    3 |
+-------+------+
3 rows in set (0.00 sec)

mysql> select * from pet where name = 'danny' and seq='1';
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
+-------+------+
1 row in set (0.00 sec)

mysql> select * from pet where name = 'danny' or seq='2';  
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
| bell  |    2 |
+-------+------+
2 rows in set (0.00 sec)

mysql> select * from pet where name = 'danny' or '1'='1' and seq='1';
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
+-------+------+
1 row in set (0.00 sec)

mysql> select * from pet where name = 'danny' or '1'='1' and seq='2'; //注意看此處
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
| bell  |    2 |
+-------+------+
2 rows in set (0.00 sec)

mysql> select * from pet where name ='danny' or '1'='2' and seq='2';  //注意看此處
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
+-------+------+
1 row in set (0.19 sec)

0x02 NOT實(shí)驗(yàn)

mysql> select * from pet where not name ='danny' or '1'='1' and seq='1'; //關(guān)于NOT，NOT雖然優(yōu)先級(jí)最高掩缓，但是他的作用域只到OR雪情，如果NOT的作用域是整個(gè)where的話，那結(jié)果應(yīng)該是bell和sunny
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
| bell  |    2 |
| sunny |    3 |
+-------+------+
3 rows in set (0.00 sec)

mysql> select * from pet where not name ='danny' and seq='1'; //作用域只到AND你辣，總結(jié)一下就是NOT只到最近的一個(gè)邏輯運(yùn)算符巡通。
Empty set (0.00 sec)

mysql> select * from pet where not name ='danny' and seq='2';
+------+------+
| name | seq  |
+------+------+
| bell |    2 |
+------+------+
1 row in set (0.00 sec)

mysql> select * from pet where not (name ='danny' and seq='2');
+-------+------+
| name  | seq  |
+-------+------+
| danny |    1 |
| bell  |    2 |
| sunny |    3 |
+-------+------+
3 rows in set (0.00 sec)

mysql> select * from pet where not name ='danny' and seq='2' or seq='3'; //最后一個(gè)例子再次佐證
+-------+------+
| name  | seq  |
+-------+------+
| bell  |    2 |
| sunny |    3 |
+-------+------+
2 rows in set (0.00 sec)