web安全作业

admin • 2022-01-06 09:14 • 安全

内容：.

自己写一个登陆页面，并能实现对接数据库，判断用户名与密码是否正确。
练习sql-map-master的1-7关

test.php

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
<H2>欢迎来到西安欧鹏</H2>
<body>
    <P>登录</P>
<form name="input" action="welcome.php" method="get">
    user:<input type="text" name="user">
    password:<input type="password" name="password">
    <input type="submit" value="登录">
</form>
</body>
</html>

welcome.php

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
</html>
<?php
$username=$_GET['user'];
$password=$_GET['password'];
if($username==NULL or $password==null)
{
    echo "用户名或密码不得为空";
}
else
{
    $conn=mysqli_connect('127.0.0.1','root','cangshu123@','test');
}
if(!$conn)
{
    die("连接失败:" .mysql_connect_error());
}
echo"数据库连接成功";
$sql="select users,password from test.users where users='$username' and password='$password'";
$result=mysqli_query($conn,$sql);
$row=mysqli_fetch_assoc($result);
if ($row)
{
    echo "登录成功，欢迎来到西安欧鹏.$username";
}
else
{
    echo "登录失败<a href='test.php'>重新登录";
}

mysql部分：

先建立库test

create database test；

再建立users表

mysql> create table users
-> (
-> users varchar(20),
-> password varchar(30) not null
-> )
-> ;

再向users表插入数据

insert into users (users,password) values('admin','123456')；

最后再查询数据是否插入成功