bWAPP--low--HTML Injection - Reflected (POST)
只不过是把传递方式换成post，
防护的三个级别和内容与GET相同
1 function htmli($data) 2 { 3 4 switch($_COOKIE["security_level"]) 5 { 6 7 case "0" : 8 9 $data = no_check($data); 10 break; 11 12 case "1" : 13 14 $data = xss_check_1($data); 15 break; 16 17 case "2" : 18 19 $data = xss_check_3($data); 20 break; 21 22 default : 23 24 $data = no_check($data); 25 break;; 26 27 } 28 29 return $data; 30 31 } 32 33 <label>Set your security level:</label><br /> 34 35 <select name="security_level"> 36 37 <option value="0">low</option> 38 <option value="1">medium</option> 39 <option value="2">high</option> 40 41 </select>
1 <div id="main"> 2 3 <h1>HTML Injection - Reflected (POST)</h1> 4 5 <p>Enter your first and last name:</p> 6 7 <form action="<?php echo($_SERVER["SCRIPT_NAME"]);?>" method="POST"> 8 9 <p><label for="firstname">First name:</label><br /> 10 <input type="text" id="firstname" name="firstname"></p> 11 12 <p><label for="lastname">Last name:</label><br /> 13 <input type="text" id="lastname" name="lastname"></p> 14 15 <button type="submit" name="form" value="submit">Go</button> 16 17 </form> 18 19 <br /> 20 <?php 21 22 if(isset($_POST["firstname"]) && isset($_POST["lastname"])) 23 { 24 25 $firstname = $_POST["firstname"]; 26 $lastname = $_POST["lastname"]; 27 28 if($firstname == "" or $lastname == "") 29 { 30 31 echo "<font color="red">Please enter both fields...</font>"; 32 33 } 34 35 else 36 { 37 38 echo "Welcome " . htmli($firstname) . " " . htmli($lastname); 39 40 } 41 42 } 43 44 ?> 45 46 </div>