[B! sql injection] pochi-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

pochi-p id:pochi-p

sql injectionã«é–¢ã™ã‚‹pochi-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (12)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€Œæ»‹è³€ã®ç—…é™¢ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¼±ã„ã€ã€€ã‚µãƒ¼ãƒãƒ¼ä¾µå…¥å®¹ç–‘ã®é¦™å·ã®é«˜æ ¡ç”ŸãŒç¤ºå”†ã‹ - ç”£çµŒWEST
ä»Šå¹´ï¼™æœˆã«æ»‹è³€çœŒå†…ã®ç—…é™¢ã®ã‚µãƒ¼ãƒãƒ¼ã«ä¾µå…¥ã—ã€ç®¡ç†è€…ã®ï¼©ï¼¤ã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä¸æ£ã«å…¥æ‰‹ã—ãŸã¨ã—ã¦ã€æ»‹è³€ã€å²¡å±±ä¸¡çœŒè¦ã¯ï¼’æ—¥ã¾ã§ã«ã€ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ç¦æ¢æ³•é•åã®ç–‘ã„ã§ã€é¦™å·çœŒã•ã¬ãå¸‚ã®é«˜æ ¡ï¼“å¹´ã®å°‘å¹´ï¼ˆï¼‘ï¼˜ï¼‰ã¨ã€èŒ¨åŸŽçœŒå¤æ²³å¸‚ã®é«˜ï¼‘ã®å°‘å¹´ï¼ˆï¼‘ï¼•ï¼‰ã‚’ã€ãã‚Œãžã‚Œé€®æ•ã—ãŸã€‚ æœæŸ»é–¢ä¿‚è€…ã«ã‚ˆã‚‹ã¨ã€ï¼’äººã«å…±è¬€é–¢ä¿‚ã¯ãªã„ãŒã€ä¼šå“¡åˆ¶äº¤æµã‚µã‚¤ãƒˆï¼ˆï¼³ï¼®ï¼³ï¼‰ã§é€£çµ¡ã‚’å–ã‚Šåˆã£ã¦ã„ãŸã€‚é¦™å·ã®é«˜æ ¡ç”ŸãŒå…ˆã«ç—…é™¢ã®ã‚µãƒ¼ãƒãƒ¼ã«ä¾µå…¥ã—ã€ã€Œã“ã“ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ã¯å¼±ã„ã€ã¨èŒ¨åŸŽã®é«˜æ ¡ç”Ÿã«æ•™ãˆãŸç–‘ã„ãŒã‚ã‚‹ã€‚ é¦™å·ã®é«˜æ ¡ç”Ÿã¯ã€Œï¼“å¹´å‰ã‹ã‚‰å¤šãã®æ–½è¨ã«ä¾µå…¥ã—ãŸã€‚ä»–äººã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’å–ã‚Šã€è²·ã„ç‰©ã‚’ã™ã‚‹ã®ãŒç›®çš„ã ã£ãŸã€ã¨ä¾›è¿°ã€‚èŒ¨åŸŽã®é«˜æ ¡ç”Ÿã‚‚ã€Œå€‹äººæƒ…å ±ã‚’ç›—ã¿ã€ãŠé‡‘ã«ã—ã‚ˆã†ã¨ã—ãŸã€ã¨è©±ã—ã¦ã„ã‚‹ã€‚ é€®æ•å®¹ç–‘ã¯ãã‚Œãžã‚Œï¼™æœˆï¼—æ—¥ã€è‡ªå®…ã®ãƒ‘ã‚½ã‚³ãƒ³ã‹ã‚‰æ»‹è³€çœŒã®ç—…é™¢ã®ã‚µãƒ¼ãƒãƒ¼ã«ä¾µå…¥ã€ï¼©ï¼¤ã‚’ä¸æ£å–å¾—ã—ãŸç–‘ã„ã€‚ãƒãƒƒã‚ãƒ³ã‚°ã®æ‰‹å£ã®ä¸€ã¤ã§ã€ãƒ—ãƒã‚°ãƒ©ãƒ è¨€èªžã€Œï¼³ï¼±ï¼¬ã€ã«ä¸æ£ãªæŒ‡
pochi-p 2016/12/09
sql injection

news

security
ãƒªãƒ³ã‚¯
http://www.jellyfish-novels.net/2016/11/sql.html
pochi-p 2016/12/06
ç´ äººã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³èª¬æ˜Žã™ã‚‹ãªã‚‰ã€ŒB'zã‚„I'veã‚„L'Arc-en-CielãŒDBã«ç™»éŒ²å‡ºæ¥ãªã„è‡´å‘½çš„æ¬ é™¥ã€‚è‡´å‘½çš„æ¬ é™¥ã ã‹ã‚‰æ”»æ’ƒã‚‚å¯èƒ½ã€‚å½“ãŸã‚Šå‰ã®å¯¾å¿œã™ã‚Œã°è‡ªç„¶ã¨æ”»æ’ƒã‚‚é˜²ã’ã‚‹ã€ã ã‘ã§è‰¯ã„æ°—ãŒã€‚

security

sql injection
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾å¿œã—ãªã„ã®ï¼Ÿ - masalibã®æ—¥è¨˜
ã“ã“æœ€è¿‘ã¯ã‚²ãƒ¼ãƒ ã‚„ ä»•äº‹ã«å¿™ã—ãã¦ãƒ–ãƒã‚°ã®æ›´æ–°ã‚’ã•ã¼ã£ã¦ã„ã¾ã—ãŸ m(_ _)m å¤–æ³¨ã•ã‚“ã¨ã„ã£ã—ã‚‡ã«ä»•äº‹ã™ã‚‹ã‚ˆã†ã«ãªã£ã¦ ä¸€ç•ªãƒ“ãƒƒã‚¯ãƒªã—ãŸã®ã¯ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾å¿œã—ã¦ã„ãªã„äº‹ ãƒžã‚¸ã§ãƒ»ãƒ»ãƒ» ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®é–¢æ•°ãŒç”¨æ„ã•ã‚Œã¦ã„ã‚‹ã®ã«ãã‚Œã‚’ã¤ã‹ã‚ãšã« ç‹¬è‡ªã§SQLã‚’æ›¸ã„ã¦ã„ã‚‹ãƒ»ãƒ»ãƒ»ãƒ» æ°—ãŒã¤ã„ãŸã®ã¯å¤–æ³¨ã•ã‚“ãŒä½œã£ãŸã‚½ãƒ¼ã‚¹ã‚’ã‚‚ã¨ã« ä¼¼ãŸã‚ˆã†ãªæ©Ÿèƒ½ã‚’ä½œã‚ã†ã¨ã—ãŸã‚‰ãƒ“ãƒƒã‚¯ãƒª ã„ã‚„ã„ã‚„ã„ã‚„ãƒ»ãƒ»ãƒ»ãƒ» ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã«å¾“ã†ã¹ãã ã‚ã†ãƒ»ãƒ»ãƒ» ã‚ã¨ã‹ã‚‰å…¥ã£ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã ã‘ã«ã„ã¾ã•ã‚‰æˆ»ã‚Œãªã„ã‘ã© ã‚¤ãƒ³ãƒ•ãƒ©ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨ã—ã¦SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’ã„ã‚Œã¦ã„ãªã„ã®ã¯è¨±ã›ãªã„ï¼ï¼ å…¨ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ã‚³ãƒ¼ãƒ‰ãƒ¬ãƒ“ãƒ¥ãƒ¼ã—ãªã„ã¨ã„ã‘ãªã„ã¨ã‹ ãƒžã‚¸æ‚²ã—ã„ãƒ»ãƒ»ãƒ»
pochi-p 2016/06/09
éŸ³æ¥½ç³»ã®ã‚·ã‚¹ãƒ†ãƒ ã§ã‚ã‚Œã°ã€ŒãŠå‰ç¨²è‘‰ã•ã‚“ï¼†æ¾æœ¬ã•ã‚“ã«å–§å˜©å£²ã£ã¦ã‚“ã®ï¼ï¼Ÿã€€B'zã‚’å…¨å¦å®šãªã®ï¼ï¼Ÿã€€æˆ¦äº‰ãªã®ï¼ï¼Ÿã€ã£ã¦è¨€ã£ã¦ã‚ã’ã¾ã—ã‚‡ã†ã€‚ï¼ˆæ’ä¾‹ã®ãƒã‚¿ï¼‰

security

sql injection
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦ã€‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å®Ÿä¾‹ã¨ã—ã¦æ›¸ç±ã«è¨˜è¼‰ã•ã‚Œã¦ã„ãŸã“ã¨ã§ä¸æ˜Žç‚¹ãŒã‚ã‚Šã¾ã—ãŸã®ã§ã€æ•™ãˆã¦ãã ã•ã„ã€‚ ... - Yahoo!çŸ¥æµè¢‹
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦ã€‚ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å®Ÿä¾‹ã¨ã—ã¦æ›¸ç±ã«è¨˜è¼‰ã•ã‚Œã¦ ã„ãŸã“ã¨ã§ä¸æ˜Žç‚¹ãŒã‚ã‚Šã¾ã—ãŸã®ã§ã€æ•™ãˆã¦ãã ã•ã„ã€‚ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦ã€‚ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å®Ÿä¾‹ã¨ã—ã¦æ›¸ç±ã«è¨˜è¼‰ã•ã‚Œã¦ ã„ãŸã“ã¨ã§ä¸æ˜Žç‚¹ãŒã‚ã‚Šã¾ã—ãŸã®ã§ã€æ•™ãˆã¦ãã ã•ã„ã€‚ â‘ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã‚ˆã‚‹SQLæ–‡ã®çµ„ã¿ç«‹ã¦ãŒã€ ä¸‹è¨˜ã¨ã—ã¦ã€ã‚·ãƒ³ã‚°ãƒ«ã‚¯ã‚©ãƒ¼ãƒ†ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ã® å…¥åŠ›å€¤ã‚’å…¥ã‚Œã‚‹ã€‚ select * from user where id = ' ': â‘¡ â‘ ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ã®å…¥åŠ›å€¤ã¨ã—ã¦ã€ä¸‹è¨˜ã‚’ å…¥åŠ›ã™ã‚‹ã€‚ ' OR 'A' = 'A' -- â‘¡ã®å…¥åŠ›å€¤ã® ã‚³ãƒ¡ãƒ³ãƒˆã€Œ--ã€ã¯ä½•æ•…å¿…è¦ãªã®ã§ã—ã‚‡ã†ã‹ï¼Ÿ ä¸‹è¨˜ã§ã‚‚ã‚ˆã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ï¼Ÿ ' OR 'A' = 'A ä½•æ•…ã‚ã–ã‚ã–ã‚³ãƒ¡ãƒ³ãƒˆã‚’ã¤ã‘ã¦ã„ã‚‹ã‹ æ•™ãˆã¦ã„ãŸã ã‘ã¾ã™ã§ã—ã‚‡ã†ã‹ï¼Ÿ
pochi-p 2016/02/14
sql injection
ãƒªãƒ³ã‚¯
ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã€‘å¾³ä¸¸å…ˆç”Ÿã«æ€’ã‚‰ã‚Œãªã„ã€å‹•çš„SQLã®å®‰å…¨ãªçµ„ã¿ç«‹ã¦æ–¹
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’ãƒ»ãƒ»ãƒ»é§†é€ã—ã¦ã‚„ã‚‹ï¼ï¼ ã“ã®ä¸–ã‹ã‚‰ãƒ»ãƒ»ãƒ»ä¸€åŒ¹æ®‹ã‚‰ãšï¼ï¼ (PHPã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹2015) Read less
pochi-p 2015/10/08
ã„ã¤ãžã‚„ã©ã£ã‹ã§ã€Œ'SQLæ–‡å—åˆ—åž‹'ã¨'æ–‡å—åˆ—åž‹'ã‚’åŒºåˆ¥ã—ã¦ã€æ–‡å—åˆ—æ¼”ç®—åã‚’ä½¿ãˆãªãã—ã¡ã‚ƒã„ã¾ã—ã‚‡ã†ã€ã£ã¦è¨€ã£ã¦ãŸã®ã¨æ ¹ã£ã“ã¯ä¸€ç·’ã®ç™ºæƒ³ã‹ãªï¼Ÿã€€æœ€çµ‚ç›®æ¨™ã¯åˆ†ã‹ã‚‹ã‘ã©ã€ç¾çŠ¶ã®é¸æŠžè‚¢ã¯ã©ã‚Œã ã‘ã‚ã‚‹ã®ã ã‚ã†â€¦ï¼Ÿ

sql injection

security

php
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚‚ã‚Œã®è²¬ä»»ã‚’é–‹ç™ºä¼šç¤¾ã«å•ã†åˆ¤æ±º
ãƒã‚¤ãƒ³ãƒˆã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ Xç¤¾ï¼ˆåŽŸå‘Šï¼‰ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ç‰¹ã«æŒ‡ç¤ºã¯ã—ã¦ã„ãªã‹ã£ãŸ æå®³è³ å„Ÿã«ã¤ã„ã¦å€‹åˆ¥å¥‘ç´„ã«å®šã‚ã‚‹å¥‘ç´„é‡‘é¡ã®ç¯„å›²å†…ã¨ã™ã‚‹æå®³è³ å„Ÿè²¬ä»»åˆ¶é™ãŒã‚ã£ãŸ å½“åˆã‚·ã‚¹ãƒ†ãƒ ã¯ã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã‚’å¤–éƒ¨å§”è¨—ã—ç›´æŽ¥ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’æ‰±ã£ã¦ã„ãªã‹ã£ãŸ Xç¤¾ãŒã€Œã‚«ãƒ¼ãƒ‰ä¼šç¤¾æ¯Žã®æ±ºæ¸ˆé‡‘é¡ã‚’çŸ¥ã‚ŠãŸã„ã€ã¨Yç¤¾ã«ä¾é ¼ã‚’ã—ã¦ã€ãã®çµæžœã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ã„ã£ãŸã‚“DBã«ä¿å˜ã™ã‚‹ä»•æ§˜ã¨ãªã£ãŸï¼ˆ2010å¹´1æœˆ29æ—¥ï¼‰ Xç¤¾ã‹ã‚‰ã®å•ã„åˆã‚ã›ã«å¯¾ã—ã¦Yç¤¾ã¯ã€ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ä¿æŒã—ãªã„æ–¹å¼ã«å¤‰æ›´ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã€ãã®ã»ã†ãŒå®‰å…¨ã¨ãªã‚Šã€è²»ç”¨ã¯20ä¸‡å††ç¨‹åº¦ã§ã‚ã‚‹æ—¨ã‚’ä¼ãˆãŸï¼ˆ2010å¹´9æœˆ27æ—¥ï¼‰ãŒã€ãã®å¾ŒXç¤¾ã¯æ”¹è‰¯ã®æŒ‡ç¤ºã‚’ã—ãªã‹ã£ãŸ ä»¥ä¸‹ã®è„†å¼±æ€§ãã®ä»–ãŒèªã‚ã‚‰ã‚ŒãŸ ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†æ©Ÿèƒ½ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒ admin/password ã§ã‚ã£ãŸ å€‹äººæƒ…å ±ãŒè¨˜è¼‰ã•ã‚ŒãŸãŠå•ã„åˆã‚ã›ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®é–²è¦§ãŒå¯èƒ½ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒªã‚¹ãƒ†ã‚£ãƒ³ã‚°ã¨æ„å›³ã—ãªã„ãƒ•ã‚¡ã‚¤
pochi-p 2015/01/23
ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¯ï¼ˆãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ä¸å…·åˆã§ã‚‚ãªã„é™ã‚Šï¼‰å½“ãŸã‚Šå‰ã«å¯¾ç–ã—ã‚ˆã†ã‚ˆã€ã¨ã¯æ€ã†ã‘ã©ã€è‰²ã€…ã‚‚ã«ã‚‡ã‚‹éƒ¨åˆ†ã‚‚â€¦ã€‚ / ã¨ã‚Šã‚ãˆãšSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”¾ç½®ã®ç³žï¼¸ï¼¸ã‚’è„…ã™ææ–™ã¨ã—ã¦å½¹ç«‹ãŸã›ã¦é ‚ã“ã†ã‹ã€‚

security

sql injection

è£åˆ¤
ãƒªãƒ³ã‚¯
DeNA Engineering - DeNAã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒãƒ¼ã‚¿ãƒ«ã‚µã‚¤ãƒˆ
æŠ€è¡“ã‚’æ´»ã‹ã—ã€æ–°ã—ã„ä¾¡å€¤ã‚’å‰µé€ ã™ã‚‹ DeNAã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¯ã€æƒ³åƒã‚’è¶…ãˆã‚‹Delightã‚’å±Šã‘ã‚‹ãŸã‚ã«ä½•ãŒã§ãã‚‹ã‹ã‚’è€ƒãˆã€æŠ€è¡“åŠ›ã¨ç™ºæƒ³åŠ›ã§æ–°ã—ã„ä¾¡å€¤ã‚’ç”Ÿã¿å‡ºã—ã¦ã„ã¾ã™ã€‚ å¤šæ§˜ãªå°‚é–€æ€§ã‚’æŒã£ãŸã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒåˆ‡ç£‹ç¢ç£¨ã—ã€äº’ã„ã«åˆºæ¿€ã—åˆãˆã‚‹ç’°å¢ƒã‚„åˆ¶åº¦ãŒã•ã‚‰ãªã‚‹æˆé•·ã¸ã¨ã¤ãªã’ã¾ã™ã€‚
pochi-p 2014/07/05
ã‚„ã£ã±ã‚Šãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ã£ã¦åž‹æŒ‡å®šå‡ºæ¥ãŸæ–¹ãŒè‰¯ã„ã‚ˆãã€‚å°‘ãªãã¨ã‚‚SQLã‚’è¨˜è¿°ã—ãŸæ™‚ç‚¹ã§SQLå´ã®åž‹ã¯ç¢ºå®šã™ã‚‹ã‚“ã ã—ã€‚

sql injection

èˆˆå‘³æ·±ã„

security
ãƒªãƒ³ã‚¯
æ•™è¨“ã¯ãªãœç”Ÿã‹ã•ã‚Œãªã‹ã£ãŸã®ã‹ï¼šITpro
ãƒ¯ã‚³ãƒ¼ãƒ«ã¯2æœˆ8æ—¥ã‹ã‚‰ï¼Œç´„3ã‚«æœˆã«ã‚ãŸã£ã¦é–‰éŽ–ã—ã¦ã„ãŸECã‚µã‚¤ãƒˆã‚’å†é–‹ã™ã‚‹ã€‚ãƒ¯ã‚³ãƒ¼ãƒ«ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚·ãƒ§ãƒƒãƒ—ã§ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚‹å€‹äººæƒ…å ±æ¼ãˆã„äº‹ä»¶ãŒç™ºç”Ÿã—ãŸã®ã¯2005å¹´11æœˆã€‚5124ä»¶ã®æƒ…å ±ã®ä¸ã«ã¯ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ç•ªå·ãŒå«ã¾ã‚ŒãŸæƒ…å ±ã‚‚ã‚ã‚Šï¼Œã‚«ãƒ¼ãƒ‰ç•ªå·ã‚’ä¸æ£ä½¿ç”¨ã•ã‚ŒãŸé¡§å®¢ã®å•ã„åˆã‚ã›ã«ã‚ˆã‚Šç™ºè¦šã—ãŸã€‚ ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ä½¿ç”¨ã•ã‚ŒãŸã®ã¯ï¼ŒSQLæ–‡ã‚’å¤–éƒ¨ã‹ã‚‰é€ã‚Šè¾¼ã‚€ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã¨å‘¼ã°ã‚Œã‚‹æ‰‹å£ã ã€‚ã“ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¯ï¼Œ2005å¹´5æœˆã«ç™ºç”Ÿã—ãŸã‚«ã‚«ã‚¯ã‚³ãƒ ã‚„OZmallãªã©ã¸ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹äº‹ä»¶ã§ã‚‚åˆ©ç”¨ã•ã‚ŒãŸã¨ã•ã‚Œã‚‹ã€‚ ç‰¹ã«ã‚«ã‚«ã‚¯ã‚³ãƒ ã®äº‹ä»¶ã¯å…¨å›½ç´™ã§ã‚‚å ±é“ã•ã‚Œã‚‹ãªã©ï¼Œå¤§ããªè©±é¡Œã«ãªã£ãŸã€‚ã«ã‚‚ã‹ã‹ã‚ã‚‰ãšï¼Œãƒ¯ã‚³ãƒ¼ãƒ«ã®äº‹ä»¶ã¯ç™ºç”Ÿã—ãŸã€‚æ•™è¨“ã¯ç”Ÿã‹ã•ã‚Œãªã‹ã£ãŸã®ã ã‚ã†ã‹ã€‚ å®Ÿã¯ãƒ¯ã‚³ãƒ¼ãƒ«ã®æ‹…å½“è€…ã¯ï¼Œã‚·ã‚¹ãƒ†ãƒ ã‚’é–‹ç™ºã—ãŸNECãƒã‚¯ã‚µã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã‚ºã«å¯¾ã—ï¼Œ2005å¹´7æœˆæœ«ã«å•ã„åˆã‚ã›ã‚’è¡Œã£ã¦ã„ãŸã¨ã„ã†ã€‚ã€Œ
pochi-p 2013/12/29
2006å¹´æ™‚ç‚¹ã®è©±ã§ã“ã‚“ãªã‚“ã ã£ãŸã®ã‹â€¦ã€‚ã¨ã¯ã„ãˆã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ç››ã‚Šè¾¼ã‚“ã ã€ã¾ã§ã¯ç„¡ç†çŸ¢ç†ç›®ã‚’æ½°ã‚Œã¦ã‚‚ã€å¯¾å¿œç„¡è¦–ï¼†æ”¾ç½®ã¯æœ‰ã‚Šå¾—ãªã„ã®ã ã‘ã©â€¦ã€‚ã€Œä¿®æ£ã«é«˜é¡è²»ç”¨ã‚’ãµã£ã‹ã‘ãŸã€æ–¹ãŒãƒžã‚·ã£ã¦ã©ã†ã‚ˆã€‚

ã“ã‚Œã¯ã²ã©ã„

security

itæ¥ç•Œ

sql injection
ãƒªãƒ³ã‚¯
SQLè˜åˆ¥åã¯çµå±€ã©ã†ã™ã‚Œã°ã‚ˆã„ã‹
ä»Šã¾ã§2å›žã«ã‚ãŸã£ã¦ã€SQLè˜åˆ¥åã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å•é¡Œã‚’å–ã‚Šä¸Šã’ã¾ã—ãŸã€‚ é–“é•ã„ã ã‚‰ã‘ã®SQLè˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ— SQLè˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®ãƒã‚°ã®äº‹ä¾‹ 3å›žç›®ã¨ãªã‚‹æœ¬ç¨¿ã§ã¯ã€SQLè˜åˆ¥åã®å–ã‚Šæ‰±ã„ã«é–¢ã™ã‚‹å•é¡Œã‚’æ•´ç†ã—ã¦ï½¤ä¸€èˆ¬çš„ãªåŽŸå‰‡ã‚’å°ŽããŸã„ã¨æ€ã„ã¾ã™ã€‚ SQLæ–‡ãŒå‹•çš„ã«å¤‰åŒ–ã™ã‚‹å ´åˆã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç– ã€Œé–“é•ã„ã ã‚‰ã‘ã®â€¦ã€ã§ç¤ºã—ãŸã‚ˆã†ã«ã€è˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒå¿…è¦ãªå±€é¢ã§ãã‚ŒãŒæ´©ã‚Œã¦ã„ã‚‹ã¨è„†å¼±æ€§ã®è¦å› ã«ãªã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ãŒã€ãã‚Œã¯å¤–éƒ¨ã‹ã‚‰æŒ‡å®šã—ãŸãƒ‡ãƒ¼ã‚¿ã«ã‚ˆã‚Šã€SQLæ–‡ã®æ§‹é€ ãŒå¤‰åŒ–ã—ã¦ã—ã¾ã„ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è¦ä»¶ã«ãªã„SQLå‘¼ã³å‡ºã—ãŒãªã•ã‚Œã¦ã—ã¾ã†ã‹ã‚‰ã§ã—ãŸã€‚ ã—ã‹ã—ã€ã€Œé–“é•ã„ã ã‚‰ã‘â€¦ã€ã®å¾ŒåŠã§ç¤ºã—ãŸã‚ˆã†ã«ã€è˜åˆ¥åã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã ã‘ã§ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã‚’é˜²ãã“ã¨ã¯ã§ããšã€æƒ…å ±æ¼æ´©ã‚’æ‹›ã„ã¦ã—ã¾ã„ã¾ã—ãŸã€‚å¤–éƒ¨ã‹ã‚‰ä»»æ„ã®SQLè˜åˆ¥åã‚’æŒ‡å®šã§ãã‚‹ã“ã¨ãŒå•é¡Œã¨ã„ã†çµè«–ã§ã—ãŸã€‚ ä¸Šè¨˜ã®ã‚ˆã†ã«ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼
pochi-p 2013/12/28
security

sql injection
ãƒªãƒ³ã‚¯
é–“é•ã„ã ã‚‰ã‘ã®SQLè˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ã“ã‚Œã‹ã‚‰3å›žé€£è¼‰ã®äºˆå®šã§ã€SQLè˜åˆ¥åã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å•é¡Œã«ã¤ã„ã¦è¨˜äº‹ã‚’æ›¸ãã¾ã™ã€‚SQLè˜åˆ¥åã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«ã¤ã„ã¦ã¯ã‚ã¾ã‚Šè§£èª¬è¨˜äº‹ãªã©ãŒãªãã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢é–“ã§ååˆ†ãªåˆæ„ãŒãªã„ã‚ˆã†ãªæ°—ãŒã—ã¾ã™ã®ã§ã€ã“ã‚Œã‚‰ã®è¨˜äº‹ãŒè°è«–ã®ãã£ã‹ã‘ã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ 3å›žã®äºˆå®šã¯ä»¥ä¸‹ã®ã¨ãŠã‚Šã§ã™ã€‚ é–“é•ã„ã ã‚‰ã‘ã®SQLè˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ—(æœ¬ç¨¿) SQLè˜åˆ¥åã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®ãƒã‚°ã®äº‹ä¾‹ SQLè˜åˆ¥åã¯çµå±€ã©ã†ã™ã‚Œã°ã‚ˆã„ã‹ ã¨ã„ã†ã“ã¨ã§ã€ã¾ãšã¯SQLè˜åˆ¥åã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å¤±æ•—ä¾‹ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ã“ã®å¤±æ•—ä¾‹ã¯ã‚ãã¾ã§èª¬æ˜Žã®ãŸã‚ã«ä½œã£ãŸã‚‚ã®ã§ã€å®Ÿéš›ã®ã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã¾ãŸã€æƒ³å®šãŒã€Œã‚ã‚Šãˆãªã„ã€ã¨æ€ã‚ã‚Œã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€æ„å›³çš„ãªã‚‚ã®ã§ã™ã®ã§ã”å®¹èµ¦ã„ãŸã ã‘ã‚Œã°ã¨æ€ã„ã¾ã™ã€‚ã¾ãŸã€ã€Œé–“é•ã„ã ã‚‰ã‘ã®ã€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã¯ã€ä»Šå›žã®é¡ŒæãŒé–“é•ã„ã ã‚‰ã‘ã¨ã„ã†æ„å‘³ã§ã‚ã‚Šã€å··ã®SQLå‘¼ã³å‡ºã—ãŒãã†ã§ã‚ã‚‹ã¨ã„ã†æ„å‘³ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚æœ¬ç¨¿ã«ç™»å ´ã™ã‚‹äººç‰©ã¨å›£
pochi-p 2013/12/26
security

sql injection
ãƒªãƒ³ã‚¯
ä¿ºã®è„³å†…é¸æŠžè‚¢ãŒã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚’å…¨åŠ›ã§é‚ªé”ã—ã¦ã„ã‚‹ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
PHP Advent Calendar 2013 in Adventarã®19æ—¥ç›®ã§ã™ã€‚æ˜¨æ—¥ã‚‚ç§ã®ã€ŒPDOã§ã®æ•°å€¤åˆ—ã®æ‰±ã„ã«ã¯ãƒ¯ãƒŠãŒã„ã£ã±ã„ï¼ˆ2ï¼‰ã€ã§ã—ãŸã€‚ ã†ã£ã‹ã‚Štogetterãªã‚“ã‹è¦‹ã¦ã—ã¾ã„ã€ç„¡é§„ã«æ™‚é–“ã‚’ä½¿ã£ã¦ã—ã¾ã£ãŸã¨å¾Œæ‚”ã—ãŸä¸Šã«æ··ä¹±ã—ã¦ã—ã¾ã„ä½™è¨ˆã«ã‚ã‹ã‚‰ãªããªã£ã¦ã—ã¾ã£ãŸäººã‚‚ã„ã‚‹ã‹ã‚‚çŸ¥ã‚Œã¾ã›ã‚“ã€‚ ãã“ã§ã€ã›ã£ã‹ãã®æ©Ÿä¼šãªã®ã§ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã«ã¤ã„ã¦ã€ç¾åœ¨ã®ç§ã®è€ƒãˆã‚’ã¾ã¨ã‚ã¦ãŠã“ã†ã¨æ€ã„ã¾ã™ã€‚ é¸ã¹ â‘ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã«ãƒ—ãƒªãƒšã‚¢ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã‚’ä½¿ã† â‘¡SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã‚’ä½¿ã† ã‚‚ã—ã€ä¸Šè¨˜ã®ã‚ˆã†ãªé¸æŠžã«ã¯ã¾ã£ã¦ã—ã¾ã£ãŸã‚‰ã€ã‚ãªãŸã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã¯ã€ç¾å®Ÿçš„ã«ã¯ã€ã»ã¼100ï¼…é–“é•ã£ã¦ã„ã‚‹ã¨è¨€ãˆã‚‹ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ãƒ—ãƒªãƒšã‚¢ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã¯ã€ã“ã®ã‚ˆã†ãªå¯¾ç«‹æ§‹é€ ã«ã¯ã‚ã‚Šã¾ã›ã‚“ã‹ã‚‰ã€‚ ãªãŠã€ã“ã®è¨˜äº‹ã¯ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·
pochi-p 2013/12/26
security

sql injection
ãƒªãƒ³ã‚¯
æ›¸å¼æ–‡å—åˆ—ã«ã‚ˆã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒä¾‹
ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ãŒã‚ã‚Šã€nameã¯ç”»é¢å…¥åŠ›ãªã®ã§SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒèµ·ã“ã‚‹ã®ã§ã¯ï¼Ÿ ã¨ä½œæˆè€…ã«ç¢ºèªã—ãŸã¨ã“ã‚ã€"%s"ã—ã¦ã‚ã‚‹ã‹ã‚‰å¤§ä¸ˆå¤«ã¨ã®è¿”äº‹ã‚’ã‚‚ã‚‰ã„ã¾ã—ãŸã€‚ ãƒãƒƒãƒˆèª¿ã¹ã‚‹ã¨mysql_real_escape_stringã§ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¦ã‹ã‚‰"%s"ã§å¤‰æ›ã™ã‚Œã°å¤§ä¸ˆå¤«ã¨ã„ã£ãŸå†…å®¹ã¯è¦‹ã¤ã‘ãŸã®ã§ã™ãŒã€mysql_real_escape_stringãªã©ä¸è¦ã¨ã®è¿”äº‹ã‚’ã‚‚ã‚‰ã„ã¾ã—ãŸã€‚ ãªãœï¼Ÿã¨èžãã¨ãã†ã„ã†ã‚‚ã®ã ã¨ã—ã‹å›žç”ãŒã‚ã‚Šã¾ã›ã‚“ã€‚ ã²ã©ã„ã§ã™ãã€‚ã“ã‚Œã¯è³ªå•è€…ãŒæ£ã—ãã€sprintfã®%sã§å—ã‘ãŸã ã‘ã§ã¯ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã¨ãªã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€ã©ã†ã—ã¦ã“ã®ã‚ˆã†ãªé–“é•ã£ãŸçŸ¥è˜ãŒå‡ºã¦ããŸã®ã‹ã¨è€ƒãˆã‚‹ã«ã€æ•°å€¤ã‚’%dã§å—ã‘ã‚‹å ´åˆã¨æ··ä¹±ã—ãŸã®ã§ã¯ãªã„ã‹ã¨æ†¶æ¸¬ã—ã¾ã—ãŸã€‚æ•°å€¤ã®å ´åˆã€æ›¸å¼%dã§å—ã‘ã¦ã„ã‚Œã°ã€ä»®ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãŒå…¥åŠ›ã•ã‚ŒãŸã¨ã—ã¦ã‚‚ã€%dã§æ•´æ•°ã«å¼·åˆ¶å¤‰æ›ã•ã‚Œã‚‹ã®ã§ã€SQLã‚¤ãƒ³ã‚¸
pochi-p 2012/12/09
security

sql injection
ãƒªãƒ³ã‚¯
1