직장인 재테크

query : select * from newb_sqli where id='admin' and pw='1' or '1=1'

<?php

if($_GET[id])

{

$str = $_GET[id];

$str = str_replace("a", " ",$str);

$str = str_replace("ruby", "nimda", $str);

$ans = substr($str, 5,5);

if ($ans =="admin") {

echo "Password is [$password]";

}

else{

echo "$ans";

}

}

?>

$str = $_get[id];

$str = str_replace("a", " ",$str);

$str = str_replace("ruby", "nimda", $str);

$ans = substr($str, 5,5);

if($ans == "admin")

{

echo "password is [$password]";

}

else

{

echo "$ans";

}