相关疑难解决方法(0)

我使用SQL Inject Me Firefox插件扫描了我的登录脚本

根据测试结果,我的脚本很容易受到SQL注入攻击.以结果为例

Results:
Server Status Code: 302 Found
Tested value: &#49&#39&#32&#79&#82&#32&#39&#49&#39&#61&#39&#49
Server Status Code: 302 Found
Tested value: 1' OR '1'='1
Server Status Code: 302 Found
Tested value: 1 UNI/**/ON SELECT ALL FROM WHERE
Server Status Code: 302 Found
Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31

我的剧本

1. login.php - 登录表单

2. check-login.php - 检查登录详细信息,这是代码.

   $ email = clean($ _ POST ['username']); $ pass = clean($ _ POST ['password']); $ user ="select*from tbl_admin where admin ='$ email'and pass ='$ pass'";

   //一些代码

   $ _SESSION ['login_mes'] …