sql注入中and和or执行的优先级

sql语句中，and 优先级大于 or

数据库表结构

mysql> desc vul;
+--------+-------------+------+-----+---------+----------------+
| Field  | Type        | Null | Key | Default | Extra          |
+--------+-------------+------+-----+---------+----------------+
| id     | int(11)     | NO   | PRI | NULL    | auto_increment |
| type   | varchar(50) | YES  |     | NULL    |                |
| vul_id | int(11)     | YES  |     | NULL    |                |
+--------+-------------+------+-----+---------+----------------+

正常查询

mysql> select * from vul where id=4;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
+----+-----------------------------------------+--------+
1 row in set (0.00 sec)

加or ，id=4(为查询条件) or 1=1(为真) ，所以sql会把所有id查出来

mysql> select * from vul where id=4 or 1=1;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
|  5 | git源码泄露扫描                         |      1 |
+----+-----------------------------------------+--------+

只查询满足id=4的

mysql> select * from vul where id=4 or 1=2;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
+----+-----------------------------------------+--------+

加and ,先执行id =4（真）和1=2（假），最后执行（假） or 1=1（真），所以结果为真，将所有id查询出来

mysql> select * from vul where id=4 and 1=2 or 1=1;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
|  5 | git源码泄露扫描                         |      1 |
+----+-----------------------------------------+--------+

加and, 先执行id =4（真）和1=2（假），最后执行（假） or 1=2（假），所以结果为假，所有id不满足查询条件，查表为空

mysql> select * from vul where id=4 and 1=2 or 1=2;
Empty set (0.00 sec)

再次验证：

mysql> select * from vul where id=4 or 1=1 and 1=2;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
+----+-----------------------------------------+--------+
1 row in set (0.00 sec)

mysql> select * from vul where id=4 or 1=1 and 1=1;
+----+-----------------------------------------+--------+
| id | type                                    | vul_id |
+----+-----------------------------------------+--------+
|  4 | JetBrains IDE workspace.xml文件泄露     |      1 |
|  5 | git源码泄露扫描                         |      1 |
+----+-----------------------------------------+--------+
2 rows in set (0.00 sec)

sql注入中and和or执行的优先级

猜你喜欢