SQL 语句 where 子句连等

[whoami9894]

昨天测试一个网站登录框 user=admin'='admin'-- &passwd=admin 绕过验证了。本地尝试时对连等的行为有点不理解

mysql> select * from users;
+----+-----------+----------+
| id | username  | password |
+----+-----------+----------+
|  1 | admin     | admin    |
|  3 | guest     | abcdefg  |
|  2 | anonymous | 123456   |
+----+-----------+----------+
3 rows in set (0.00 sec)

mysql> select * from users where username='admin'='admin';
+----+-----------+----------+
| id | username  | password |
+----+-----------+----------+
|  3 | guest     | abcdefg  |
|  2 | anonymous | 123456   |
+----+-----------+----------+
2 rows in set, 1 warning (0.00 sec)

mysql> select * from users where username='admin'='guest';
+----+-----------+----------+
| id | username  | password |
+----+-----------+----------+
|  3 | guest     | abcdefg  |
|  2 | anonymous | 123456   |
+----+-----------+----------+
2 rows in set, 1 warning (0.00 sec)

mysql> select * from users where username='admin'='a';
+----+-----------+----------+
| id | username  | password |
+----+-----------+----------+
|  3 | guest     | abcdefg  |
|  2 | anonymous | 123456   |
+----+-----------+----------+
2 rows in set, 1 warning (0.00 sec)

mysql> select * from users where username='admin'='1';
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | admin    | admin    |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select * from users where username='admin'='2';
Empty set (0.00 sec)

这里的解析逻辑是怎样的？

[lichao]

被 SQL 注入了

[lichao]

请使用 WHERE user = @user and passwd = @passwd 的参数化查询方式

[jzmws]

防止 sql 注入最基本的防护

[whoami9894]

@lichao
@jzmws
....我当然知道是注入，我就是做安全的，我是不明白 where 字句连等是怎么查询出数据的

[lichao]

@whoami9894 做安全的怎么会不知道 -- 后面是注释

[lichao]

@whoami9894 哦，那明白你意思了

[loading]

拼接字符串，实际拼进去就知道了。

[lichao]

select * from users where name = 0; 这个出来的结果也很奇怪，MySQL 好奇怪

[lichao]

PostgreSQL 这种语句就完全不合法

[zjsxwc]

mysql 本来就能连等：



mysql> select (2=2=2);
+---------+
| (2=2=2) |
+---------+
| 0 |
+---------+
1 row in set (0.00 sec)

mysql> select (2=2=true);
+------------+
| (2=2=true) |
+------------+
| 1 |
+------------+
1 row in set (0.00 sec)

mysql> select (2=2=1);
+---------+
| (2=2=1) |
+---------+
| 1 |
+---------+
1 row in set (0.00 sec)

[lichao]

@zjsxwc 这是 feature 还是 bug ？

[jjwjiang]

跟 JS 语法类似，连等先判断头两个，变成了 true 或者 false

[kev17]

(user= "a" ) = "b"
会选出最终结果为 true 的行
例如
```

mysql> select * from users where username='admin'='admin';
+----+-----------+----------+
| id | username | password |
+----+-----------+----------+
| 3 | guest | abcdefg |
| 2 | anonymous | 123456 |
+----+-----------+----------+
2 rows in set, 1 warning (0.00 sec)
```
结果
（ 1 ） 第一步 username='admin'的记录返回 1，第二步 true = 'admin' 返回 0，这种记录不会被选择出来

（ 2 ） 第一步 username <> 'admin'的记录返回 0，第二步 false = 'admin' 返回 1，这种记录会被选择出来

[frazy]

楼上正解~
1 就是 true，其他都是 false

[whoami9894]

@kev17
```sql
mysql> select * from users where false='admin';
+----+-----------+----------+
| id | username | password |
+----+-----------+----------+
| 1 | admin | admin |
| 3 | guest | abcdefg |
| 2 | anonymous | 123456 |
+----+-----------+----------+
3 rows in set, 1 warning (0.05 sec)

mysql> select * from users where true='admin';
Empty set, 1 warning (0.00 sec)
```

SQL 在 bool 和 str 之间比较的行为好奇怪，0='admin'返回 true

这样的话就解释通了

[tsparrot]

mysql> select * from users;
+----+-----------+----------+
| id | username | password |
+----+-----------+----------+
| 1 | admin | admin |
| 3 | guest | abcdefg |
| 2 | anonymous | 123456 |
+----+-----------+----------+
3 rows in set (0.00 sec)

mysql> select * from users where username='admin'='admin';
+----+-----------+----------+
| id | username | password |
+----+-----------+----------+
| 3 | guest | abcdefg |
| 2 | anonymous | 123456 |
+----+-----------+----------+
2 rows in set, 1 warning (0.00 sec)
楼主你好，请问你帖子里的这个查询返回的结果里为什么会有数据呢（ username='admin'返回 1，而 where 1 = ‘str’不是相当于 where 0 吗 为什么会返回数据呢

[whoami9894]

@tsparrot
'guest'='admin'='admin' => ('guest'='admin')='admin'
'guest'='admin' => 0
0='admin' => 1
所以查出所有 username != 'admin'的记录

[tsparrot]

@whoami9894 哦哦明白了，谢谢楼主