我意识到我所询问的软件至少可以说已经过时了，但这是由于对这个实验的限制。这不是一个家庭作业，只是一个跨多个操作系统和配置测试 sql 注入的实验。
我试图找到一种在 Windows Server 2003 机器上设置 MS SQL 服务器的方法，这很困难。我终于完成了所有设置，我可以在本地主机上成功运行 phpinfo()，但是在通过 htm 文件提交用户名和密码后运行查询时，出现此错误：
Array ( [0] => Array ( [0] => IMSSP [SQLSTATE] => IMSSP [1] => -49 [code] => -49 [2] => This extension requires the Microsoft SQL Server 2012 Native Client. Access the following URL to download the Microsoft SQL Server 2012 Native Client ODBC driver for x86: http://go.microsoft.com/fwlink/?LinkId=163712 [message] => This extension requires the Microsoft SQL Server 2012 Native Client. Access the following URL to download the Microsoft SQL Server 2012 Native Client ODBC driver for x86: http://go.microsoft.com/fwlink/?LinkId=163712 ) [1] => Array ( [0] => IM002 [SQLSTATE] => IM002 [1] => 0 [code] => 0 [2] => [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified [message] => [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified ) )
我安装了 Microsoft SQL Server 2008 Native Client，因为 2012 与 2003 不兼容。我已经尝试过，它只是在安装过程中导致错误。如果有人有解决方案或我可能忽略的东西，那将是完美的。
对于一些额外的见解，这是我运行的 php 文件。注意评论，它以前是一个 MySQL php 脚本：
<?php
echo "<center> <img src=\"bookstore.jpg\"><br /> ";
echo "<font color=green size=6> Database Query Results </font>";
$Id = $_POST["Id"];
$pass = $_POST["pass"];
#$name = mysql_real_escape_string($_POST["fname"]);
#$age = mysql_real_escape_string($_POST["age"]);
$db_host = '.\SQLExpress';
$db_user = 'SCADATEST';
$db_pwd = '';
$database = 'bookorders';
$table = 'Customers';
// Connect to the database server
//$con = mssql_connect('localhost', 'SCADATEST', '');
//$connectionInfo = array("UID" => $db_user, "PWD" => $db_pwd, "Database"=>$database);
//$connection = mssql_connect('localhost', 'SCADATEST', '');
//$con = sqlsrv_connect($db_host, $connectionInfo);
//if (!$con)
// {
//# die('Could not connect: ' . $age . ' '.mysql_error());
// die('Could not connect: ' . ' ' . print_r(sqlsrv_errors(), true));
// }
$connectionInfo = array( "Database"=>"$database");
$conn = sqlsrv_connect( $db_host, $connectionInfo);
if( $conn ) {
echo "Connection established.<br />";
}else{
echo "Connection could not be established.<br />";
die( print_r( sqlsrv_errors(), true));
}
// Open to the database
//mysql_select_db("bookorders") or die(mysql_error());
//Create query string
$QueryStr = 'SELECT * FROM Customers where Username=\'' . $Id . '\' and Pwd=\'' . $pass . '\';';
#$QueryStr = 'SELECT * FROM Customers; SELECT * FROM Orders; -- and Pwd=';
//$QueryStr= "SELECT * FROM Customers where Username='' OR 1=1; -- ' and Pwd='fsd';"
//echo $QueryStr ;
//echo "<br />";
$queries = preg_split("/;+(?=([^'|^\\\']*['|\\\'][^'\^\\\']*['|\\\'])*[^'\^\\\']*[^'|^\\\']$)/",$QueryStr);
#$queries = split('[/;]',$QueryStr);
// Select all records from the "Individual" table
foreach ($queries as $query){
if (strlen(trim($query)) > 0){
$result = sqlsrv_query($conn,$query) or die(mysql_error());
echo "<HR><P><table border=2><tr>";
//first print the column names as headers
for ($i=0; $i < sqlsrv_num_fields($result); $i++){
$field_info = mysql_fetch_field($result, $i);
echo "<th>{$field_info->name}</th>";
}
echo "</tr>";
// Loop thru each record (using the PHP $row variable),
while($row = sqlsrv_fetch_array($result)){
//now print the data
$c=0;
echo "<tr>";
while ($c < sqlsrv_num_fields($result)){
echo "<td>{$row[$c]}</td>";
$c++;
} //end of inner while
echo "</tr>";
}//end of outer while
echo "</table> <P> <HR>";
} //end of if
echo "<br /><br /> ";
} //end of for each
echo "<a href=\"index.html\"> Return to Home </a> ";
echo "<hr><font color=red size=1> Copyright 2013. Guillermo Francia, III-Jacksonville State <hr></center>";
sqlsrv_close($con);
?>
任何人为使其发挥作用可能获得的任何帮助都会很棒。