[B! sql] koroharoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

koroharo id:koroharo

sqlã«é–¢ã™ã‚‹koroharoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Time-based SQL Injectionã¯æ„å¤–ã«å®Ÿç”¨çš„ã ã£ãŸ
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€Time-based SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã™ãªã‚ã¡æ™‚é–“å·®ã‚’åˆ©ç”¨ã—ãŸSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒæ„å¤–ã«å®Ÿç”¨çš„ã ã£ãŸã¨ã„ã†å ±å‘Šã‚’ã—ã¾ã™ã€‚ãƒ‡ãƒ¢æ˜ åƒã‚ã‚Šã§ã™ã€‚ ã¯ã˜ã‚ã« Time-based SQL Injectionã¨ã„ã†æ”»æ’ƒãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ãƒ–ãƒ©ã‚¤ãƒ³ãƒ‰SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®ä¸€ç¨®ã§ã€ã‚ã‚‹æ¡ä»¶ã®å ´åˆã«ä¸€å®šæ™‚é–“ï¼ˆä¾‹ãˆã°5ç§’ï¼‰ã‚¹ãƒªãƒ¼ãƒ—ã—ã€ãã†ã§ãªã„æ™‚ã¨ã®å¿œç”æ™‚é–“ã®å·®ã§æƒ…å ±ã‚’ç›—ã‚‚ã†ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚1å›žã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã§1ãƒ“ãƒƒãƒˆã®æƒ…å ±ãŒå¾—ã‚‰ã‚Œã‚‹ã®ã§ã€ãã‚Œã‚’ç©ã¿é‡ãã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€ã„ãã‚‰ã§ã‚‚æƒ…å ±ã‚’ç›—ã‚ã‚‹ã¯ãšã§ã™â€¦ç†è«–çš„ã«ã¯ã€‚ ã—ã‹ã—ã€ã€Œç†å±ˆã¯ãã†ã§ã‚‚ã€æ™‚é–“ãŒæŽ›ã‹ã‚Šã™ãŽã‚‹ã‚ˆãã€ã¨ã„ã†ã“ã¨ã§ã€æ·±ãã¯è¿½ã£ã‹ã‘ã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®æ¤œæŸ»ã«ã¯æœ‰åŠ¹ã§ã‚‚ã€æ‚ªç”¨ã¨ã—ã¦ã®å®Ÿç”¨æ€§ã¯ã‚ã¾ã‚Šãªã„ã¨è€ƒãˆã¦ã„ãŸã®ã§ã™ã€‚ ãã£ã‹ã‘ ãã£ã‹ã‘ã¯ã€ä»¥ä¸‹ã®Yahoo!çŸ¥æµè¢‹ã«ä»¥ä¸‹ã®è³ªå•ã§ã™ã€‚ SQL
koroharo 2015/04/16
security

sql

injection

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
java.util.Dateã‚’java.sql.Dateã«ãã¡ã‚“ã¨å¤‰æ›ã™ã‚‹æ–¹æ³• - ã²ãŒã‚„ã™ã‚’æŠ€è¡“ãƒ–ãƒã‚°
å¤šãã®äººã¯ã“ã†ã‚„ã‚Œã°ã„ã„ã¨æ€ã£ã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ java.util.Date d = new java.util.Date(); java.sql.Date d2 = new java.sql.Date(d.getTime());ç¢ºã‹ã«ã“ã‚Œã§ã‚‚ä¸€å¿œå¤‰æ›ã¯ã§ãã¾ã™ãŒã€ãã¡ã‚“ã¨å¤‰æ›ã—ã¦ã¯ã„ã¾ã›ã‚“ã€‚java.sql.Dateã®Javadocã‚’è¦‹ã‚‹ã¨ã“ã†æ›¸ã„ã¦ã‚ã‚Šã¾ã™ã€‚ SQL DATE ã®å®šç¾©ã«å¯¾å¿œã•ã›ã‚‹ãŸã‚ã«ã€java.sql.Date ã®ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã§ãƒ©ãƒƒãƒ—ã•ã‚ŒãŸãƒŸãƒªç§’ã®å€¤ã¯ã€ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ãŒé–¢é€£ã—ãŸç‰¹å®šã®ã‚¿ã‚¤ãƒ ã‚¾ãƒ¼ãƒ³ã§æ™‚é–“ã€åˆ†ã€ç§’ã€ãƒŸãƒªç§’ã‚’ã‚¼ãƒã«è¨å®šã™ã‚‹ã“ã¨ã§ã€ã€Œæ¨™æº–åŒ–ã€ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ ã¤ã¾ã‚Šã€java.util.Date#getTime()ã‚’java.sql.Dateã«ãŸã æ¸¡ã™ã ã‘ã§ã¯ä¸ååˆ†ã§ã€ã€Œç‰¹å®šã®ã‚¿ã‚¤ãƒ ã‚¾ãƒ¼ãƒ³ã§æ™‚é–“ã€åˆ†ã€ç§’ã€ãƒŸãƒªç§’ã‚’ã‚¼ãƒã«è¨å®šã—ãªã‘ã‚Œã°ã„ã‘ãªã„ã€ã®ã§ã™ã€‚ã
koroharo 2012/12/17
java

sql

programming

date
ãƒªãƒ³ã‚¯
å…¥åŠ›ãƒ•ã‚©ãƒ¼ãƒ ä¸ã®å…¨ã¦ã®åŠè§’ã‚¹ãƒšãƒ¼ã‚¹''ã‚’å…¨è§’ã‚¹ãƒšãƒ¼ã‚¹''ã«å¤‰æ›ã™ã‚‹å‡¦ç†ã ã‘ã§SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ã’ã¾ã™ã‹? - è£œè¶³... - Yahoo!çŸ¥æµè¢‹
å…¥åŠ›ãƒ•ã‚©ãƒ¼ãƒ ä¸ã®å…¨ã¦ã®åŠè§’ã‚¹ãƒšãƒ¼ã‚¹' 'ã‚’å…¨è§’ã‚¹ãƒšãƒ¼ã‚¹' 'ã«å¤‰æ›ã™ã‚‹å‡¦ç†ã ã‘ã§SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ã’ã¾ã™ã‹? ç„¡ç†ã¨è¨€ã†æ ¹æ‹ ã¯ä½•ã§ã™ã‹? â–¡ã‚’å…¨è§’ï½½ï¾ï¾Ÿï½°ï½½ã ã¨ã—ã¦,wikipediaã®ä¾‹ã‚’æŒ™ã’ã‚‹ã¨ SELECT * FROM users WHERE name ='(å…¥åŠ›å€¤)'; ã“ã®å…¥åŠ›å€¤ã«"t' OR 't' = 't"ã¨ã„ã†æ–‡å—åˆ—ã‚’å…¥åŠ›ã™ã‚‹ã¨,SQLï½²ï¾ï½¼ï¾žï½ªï½¸ï½¼ï½®ï¾ã§ãã¾ã™ãŒ ã“ã®æ–‡å—åˆ—ä¸ã®åŠè§’ï½½ï¾ï¾Ÿï½°ï½½ã‚’å…¨è§’ï½½ï¾ï¾Ÿï½°ï½½ã«å¤‰æ›´ã™ã‚‹ã¨ SELECT * FROM users WHERE name = 't'â–¡ORâ–¡'t'â–¡=â–¡'t'; ã¨ãªã‚Š,æ£å¸¸ãªSQLæ–‡ã§ã¯ãªããªã‚Šã¾ã™. ç§ã®æ§‹ç¯‰ã—ãŸç’°å¢ƒã§ã“ã®å‡¦ç†ã‚’å®Ÿæ–½ã—ãŸã¨ã“ã‚,SQLï½²ï¾ï½¼ï¾žï½ªï½¸ï½¼ï½®ï¾ã¯å‡ºæ¥ãªããªã‚Šã¾ã—ãŸã€‚
koroharo 2012/05/21
æ£å¸¸ãªSQLã‹ã©ã†ã‹é–¢ä¿‚ãªãã€æ„å›³ã—ãªã„SQLãŒå®Ÿè¡Œã•ã‚Œãªã„ã‚ˆã†ã«ã™ã‚‹ã®ãŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã€‚

SQL
ãƒªãƒ³ã‚¯
teacup. byGMO ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã›ï½œGMO MEDIA
teacup. byGMO ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã› teacup. byGMOã¯ã€2022å¹´8æœˆ1æ—¥ã‚’ã‚‚ã¡ã¾ã—ã¦ã€ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ã“ã‚Œã¾ã§teacup. byGMOã‚’ã”æ„›é¡§ã„ãŸã ãã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚å¿ƒã‚ˆã‚Šæ„Ÿè¬ç”³ã—ä¸Šã’ã¾ã™ã€‚ ä»Šå¾Œã¨ã‚‚ã€GMOãƒ¡ãƒ‡ã‚£ã‚¢æ ªå¼ä¼šç¤¾ã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2022å¹´8æœˆ1æ—¥
koroharo 2007/10/26
sql

oracle
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã›
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã› ã„ã¤ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã„ãŸã ãèª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ãŠå®¢æ§˜ãŒã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸã‚µãƒ¼ãƒ“ã‚¹ã¯æœ¬æ—¥ã¾ã§ã«ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ä»Šå¾Œã¨ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”æ„›é¡§ãã ã•ã„ã¾ã™ã‚ˆã†ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
koroharo 2007/10/26
sql

oracle
ãƒªãƒ³ã‚¯
ãƒ†ãƒ¼ãƒ–ãƒ«å®šç¾©ã®å¤‰æ›´ï¼ˆåˆ—ã®è¿½åŠ ã€å¤‰æ›´ã€å‰Šé™¤ï¼‰ - ã‚ªãƒ©ã‚¯ãƒ«ãƒ»Oracle SQL å…¥é–€
ãƒ†ãƒ¼ãƒ–ãƒ«å®šç¾©ã®å¤‰æ›´ï¼ˆåˆ—ã®è¿½åŠ ã€å¤‰æ›´ã€å‰Šé™¤ï¼‰ Top ï½œ Knowledgeï½œ DBæ§‹ç¯‰ï½œ æ–‡å—åˆ—é–¢æ•°ï½œ æ—¥ä»˜é–¢æ•°ï½œ é›†è¨ˆé–¢æ•°ï½œ SQLé–¢æ•°ï¼ˆã‚¢ãƒ«ãƒ•ã‚¡ãƒ™ãƒƒãƒˆé †ï¼‰ SQLï¼ˆæŠ½å‡ºãƒ»æ›´æ–°ï¼‰ï½œ SQL*Plusï½œ PL/SQLï½œ Utilityï½œ Structureï½œ ã‚¹ã‚ãƒ¼ãƒžï½œ ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ï½œ ç”¨èªžï½œ å‚è€ƒæ›¸ ALTER TABLE ï¼ˆåˆ—ã®è¿½åŠ ã€å¤‰æ›´ã€å‰Šé™¤ï¼‰ ã‚«ãƒ©ãƒ ã®è¿½åŠ ï¼ ALTER TABLE ADD column(s) è¡¨ã¸ã‚«ãƒ©ãƒ ã®è¿½åŠ è¡¨å®šç¾©ã®æœ€å¾Œã«ã®ã¿è¿½åŠ å¯èƒ½ã€‚è¡¨ã®é€”ä¸ã¸ã®æŒ¿å…¥ã‚„åˆ—ã®é †ç•ªã®å¤‰æ›´ã‚„å…¥ã‚Œæ›¿ãˆã¯ã§ããªã„ã€‚è¡¨ã®å†å®šç¾©(â€»1)ã¨ãƒ‡ãƒ¼ã‚¿ã®å†ç™»éŒ²ã‚’è¡Œãªã†å¿…è¦ãŒã‚ã‚‹ã€‚ my_table ã« TIMESTAMP ã‚«ãƒ©ãƒ time_col ã‚’è¿½åŠ ã™ã‚‹ã€‚ ALTER TABLE my_table ADD ( time_col TIMESTAMP(3) ) ; my_table ã«ä»®æƒ³åˆ— vi
koroharo 2007/10/16
sql

oracle
ãƒªãƒ³ã‚¯
ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã®åŸºç¤ŽçŸ¥è˜
â– ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã¨ã¯ ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ä¸–ç•Œã§ã€ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹(ç´¢å¼•)ã¨ã¯ãƒ†ãƒ¼ãƒ–ãƒ«ã«æ ¼ç´ã•ã‚Œã¦ã„ã‚‹ãƒ‡ãƒ¼ã‚¿ã‚’ é«˜é€Ÿã«å–ã‚Šå‡ºã™ç‚ºã®ä»•çµ„ã¿ã‚’æ„å‘³ã—ã¾ã™ã€‚ ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã‚’é©åˆ‡ã«ä½¿ç”¨ã™ã‚‹ã“ã¨ã«ã‚ˆã£ã¦SQLæ–‡ã®å¿œç”æ™‚é–“ãŒåŠ‡çš„ã«æ”¹å–„ ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã«ã¯B-Treeã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã‚’ã¯ã˜ã‚ã€ãƒ“ãƒƒãƒˆãƒžãƒƒãƒ—ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã€ é–¢æ•°ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ãªã©ã®ç¨®é¡žãŒã‚ã‚Šã¾ã™ãŒã€ã“ã“ã§ã¯æœ€ã‚‚ä¸€èˆ¬çš„ã«ä½¿ã‚ã‚Œã€ã‹ã¤ ã»ã¨ã‚“ã©ã®DBMSã§ã‚µãƒãƒ¼ãƒˆã•ã‚Œã¦ã„ã‚‹B-Treeã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã«ã¤ã„ã¦è§£èª¬ã—ã¾ã™ã€‚ â€» CREATE INDEXæ–‡ã§ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’æŒ‡å®šã—ãªã„å ´åˆã¯é€šå¸¸B-Treeã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ãŒ ä½œæˆã•ã‚Œã¾ã™ã€‚ â– B-Treeã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã®ã—ãã¿ B-Tree(Balanced Tree)ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã¯æ¬¡ã®ã‚ˆã†ãªãƒ„ãƒªãƒ¼çŠ¶ã®æ§‹é€ ã«ãªã£ã¦ã„ã¾ã™ã€‚ ãƒ„ãƒªãƒ¼ã®å…ˆé ã¯ãƒ˜ãƒƒãƒ€ãƒ–ãƒãƒƒã‚¯ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ã€‚ãƒ˜ãƒƒãƒ€ãƒ–ãƒãƒƒã‚¯ã§ã¯ã€ã‚ãƒ¼å€¤ã® ç¯„å›²
koroharo 2006/05/11
sql

db
ãƒªãƒ³ã‚¯
CASEå¼ã®ã‚¹ã‚¹ãƒ¡ / ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ»ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ä¸–ç•Œ
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã› ã„ã¤ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã„ãŸã ãèª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ãŠå®¢æ§˜ãŒã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸã‚µãƒ¼ãƒ“ã‚¹ã¯æœ¬æ—¥ã¾ã§ã«ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ä»Šå¾Œã¨ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”æ„›é¡§ãã ã•ã„ã¾ã™ã‚ˆã†ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
koroharo 2006/02/28
sql
ãƒªãƒ³ã‚¯
ãƒ¡ãƒ¼ãƒ«ãƒžã‚¬ã‚¸ãƒ³ - ãƒãƒƒã‚¯ãƒŠãƒ³ãƒãƒ¼
ãŠã‚‰! ã‚ªãƒ©! Oracle - ã©ã£ã·ã‚Šæ¤œè¨¼ç”Ÿæ´» ãƒ¡ãƒ¼ãƒ«ãƒžã‚¬ã‚¸ãƒ³ç™»éŒ²/è§£é™¤ ã“ã®ãƒ¡ãƒ¼ãƒ«ãƒžã‚¬ã‚¸ãƒ³ã‚’è³¼èªã•ã‚Œã‚‹æ–¹ã€ã¾ãŸã¯è³¼èªã‚’è§£é™¤ã•ã‚Œã‚‹æ–¹ã¯ã€ç”»é¢å·¦ã®ç™»éŒ²/è§£é™¤ãƒ•ã‚©ãƒ¼ãƒ ã«ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’å…¥åŠ›ã—ã¦ä¸‹ã•ã„ã€‚ â€»ã“ã®ãƒ¡ãƒ¼ãƒ«ãƒžã‚¬ã‚¸ãƒ³ã¯ã¾ãã¾ãã‹ã‚‰ã®é…ä¿¡ã¨ãªã‚Šã¾ã™ã€‚ ãƒãƒƒã‚¯ãƒŠãƒ³ãƒãƒ¼
koroharo 2005/12/13
db

oracle

sql
ãƒªãƒ³ã‚¯
http://st-curriculum.oracle.com/tutorial/DBXETutorial/index.htm
koroharo 2005/11/01
db

sql
ãƒªãƒ³ã‚¯
A.Ogawa's home
2025-06-17 osqledit ver.10.4.2.4 ãƒªãƒªãƒ¼ã‚¹ 2025-06-17 osqlgrid ver.6.4.1.5 ãƒªãƒªãƒ¼ã‚¹ 2025-05-23 oedit ver.9.0.0.1 ãƒªãƒªãƒ¼ã‚¹ 2025-08-02 otbedit ver.8.0.0.2 ãƒªãƒªãƒ¼ã‚¹ 2025-09-15 psqledit ver6.0.0.2 ãƒªãƒªãƒ¼ã‚¹ 2025-06-15 psqlgrid ver5.0.0.1 ãƒªãƒªãƒ¼ã‚¹
koroharo 2005/06/08
sql

software
ãƒªãƒ³ã‚¯
1