SQL注入笔记02：基于不同参数类型的注入

 

数字型
$id=$_GET['x']
Select * from news where id=$id
如：?x=1->Select * from news where id=1
注入更改：无

字符型
$id=$_GET['x']
Select * from news where id='$id'
如：?x=admin->Select * from news where id='admin'
注入：?x=admin' union select 1,2,3#
      ->Select * from news where id='admin' union select 1,2,3#'   //#屏蔽后面的字符

搜索型
$id=$_GET['x']
Select * from news where id like '%sss%'   //%是数据库中的通配符
如：?x=123->Select * from news where id like '%123%' 
注入：?x=123%' union select 1,2,3#
      ->Select * from news where id like '%123%' union select 1,2,3#%'