【文章內(nèi)容簡介】 eoutputofthatmand:代碼+++++++|Field|Type|Null|Key|Default|Extra|+++++++|Host|char(60)binary||PRI||||User|char(16)binary||PRI||||password|char(16)||||||Select_priv|enum(39。N39。,39。Y39。)|||N|||Insert_priv|enum(39。N39。,39。Y39。)|||N|||Update_priv|enum(39。N39。,39。Y39。)|||N|||Delete_priv|enum(39。N39。,39。Y39。)|||N|||Create_priv|enum(39。N39。,39。Y39。)|||N|||Drop_priv|enum(39。N39。,39。Y39。)|||N|||Reload_priv|enum(39。N39。,39。Y39。)|||N|||Shutdown_priv|enum(39。N39。,39。Y39。)|||N|||Process_priv|enum(39。N39。,39。Y39。)|||N|||File_priv|enum(39。N39。,39。Y39。)|||N|||Grant_priv|enum(39。N39。,39。Y39。)|||N|||References_priv|enum(39。N39。,39。Y39。)|||N|||Index_priv|enum(39。N39。,39。Y39。)|||N|||Alter_priv|enum(39。N39。,39。Y39。)|||N||+++++++The39。Host39。fieldisforspecifyingahostmaskfortheclientconnectingtotheserver.Thiscanincludeawildcard(%).Ifsetto39。localhost39。,onlyconnectionsfromthesamemachineareallowed.ThismeansahackerelsewhereontheInternetcan39。tconnecttoyourserverandstartguessingatpasswordsevenifheorshehastherightpassword,theconnectionwillstillberefused.The39。User39。fieldisthenameoftheuser.Thiscanalsobeawildcard,andwillthenapplytoanyuserconnectingtotheservernotspecifyingausername,butifyou39。rewantingasecureserver,youwon39。twanttodothis.The39。password39。fieldcontainsahashproducedbyusingthebuiltin39。PASSWORD39。functioninMySQL.Thesubsequentfieldseithercontain39。Y39。or39。N39。,dependingonwhatyousetthemtoo.Bydefaulttheyaresetto39。N39。(donotallowtheuserthisprivilege).FirstofallI39。dremendyoudeletealltheentriesexceptfortherootuserwiththelocalhostmask.Nowlet39。ssetupagroupofusersforthepreviouslymentioneddatabasetasks.代碼INSERTINTOuserSETHost=localhost,User=selectuser,password=PASSWORD(passforselectuser)。INSERTINTOuserSETHost=localhost,User=deleteuser,password=PASSWORD(passfordeleteuser)。INSERTINTOuserSETHost=localhost,User=insertuser,password=PASSWORD(passforinsertuser)。INSERTINTOuserSETHost=localhost,User=updateuser,password=PASSWORD(passforupdateuser)。YoumayhavenoticedIdidn39。tsetanypriviledgeswiththesemands,soalltheprivilegeshasdefaultedto39。N39。.Thisisbecausethe39。user39。tablehasglobalscope,ie.adeleteprivilegeheremeansausercandeleteanythingfromanydatabaseintheserver.Instead,wesettheprivilegesintheprivilegetableswithanarrowerscope.Enterthe39。db39。table.Thislet39。sussetprivilegesforspecificdatabasesforspecificusers.A39。DESCRIBEdb39。producesthefollowing:代碼+++++++|Field|Type|Null|Key|Default|Extra|+++++++|Host|char(60)binary||PRI||||Db|char(64)binary||PRI||||User|char(16)binary||PRI||||Select_priv|enum(39。N39。,39。Y39。)|||N|||Insert_priv|enum(39。N39。,39。Y39。)|||N|||Update_priv|enum(39。N39。,39。Y39。)|||N|||Delete_priv|enum(39。N39。,39。Y39。)|||N|||Create_priv|enum(39。N39。,39。Y39。)|||N|||Drop_priv|enum(39。N39。,39。Y39。)|||N|||Grant_priv|enum(39。N39。,39。Y39。)|||N|||References_priv|enum(39。N39。,39。Y39。)|||N|||Index_priv|enum(39。N39。,39。Y39。)|||N|||Alter_priv|enum(39。N39。,39。Y39。)|||N||+++++++The39。Host39。and39。User39。fieldshavethesamemeaningasinthe39。user39。table.The39。Db39。fieldspecifieswhichdatabasesubsequentprivilegesintherecordarereferringto.So,let39。sgiveourusersthepermissionstheyneed.It39。simportanttomentionherethatALLtheusersshouldbegiventheSELECTprivilege.ThisisbecausetheSELECTprivilegeisneededforWHEREclauses,asinsuchcasesinformationmustbereadfromthedatabase.INSERTINTOdbSETHost=localhost,Db=sqlseqdemo,User=selectuser,Select_priv=Y。INSERTINTOdbSETHost=localhost,Db=sqlseqdemo,User=deleteuser,Select_priv=Y,Delete_priv=Y。INSERTINTOdbSETHost=localhost,Db=sqlseqdemo,User=insertuser,Select_priv=Y,Insert_priv=Y。INSERTINTOdbSETHost=localhost,Db=sqlseqdemo,User=updateuser,Select_priv=Y,Update_priv=Y。Nowwehaveourlimitedprivilegeuserssetupandreadytogo.Butfirst,weneedtoreloadtheinformationfromtheprivilegetablesintoMySQLsothatthechangeswehavemadetakeeffect.Thiscanbedoneintwoways.Thefirstistosimplyshutdownandrestarttheserver,andthesecondistousemysqladminorthemysqlclient.Todoitwithmysqladmin:代碼shellmysqladminurootpflushprivilegesPassword:*********Todoitfromthemysqlclient,firstloginastherootuser,thendo:mysqlFLUSHPRIVILEGES。Thenewdatabaseusersarenowreadytobeused.Bystickingtotheseusers,anySQLinjectionholesinyourwebapplicationscanhavetheirseveritygreatlydecreased.That39。sitforthisarticle,IhopeyoulearntsomethingaboutthedangersandpreventativemeasuressurroundingSQLandMySQL.代碼Resources:TheofficialMySQLwebsite.SearchableMySQLmanualwithuserments.TheofficialPHPwebsite.ThePHPmanual,withuserments.[][2MSDOSTheForgottenToolbyflapjackboy][]InthetimessinceMSDOS,newtoolshavebeendeveloped.Rootkits,vulnerabilityscanners,1