SQL注入之如何绕过and，union，where，limit过滤绕过

最新推荐文章于 2025-03-16 15:21:57 发布

zhidaobu00

最新推荐文章于 2025-03-16 15:21:57 发布

阅读量2.9k

点赞数 2

文章标签： sql mysql 数据库

本文链接：https://blog.csdn.net/m0_57114395/article/details/120240578

版权

本文介绍了在SQL查询中，如何在遇到and、or、union等关键字被过滤时，利用&&、||和子查询来替代这些运算符进行数据筛选。同时，展示了当where和limit被过滤时，可以使用limit和groupby函数进行替代的方法，以达到相同的效果。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

当and被过滤时我们可以使用&&进行替换

mysql> select * from fristtb where id= 1 and sex=0x01;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
1 row in set (0.00 sec)

mysql> select * from fristtb where id= 1 && sex=0x01;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
1 row in set, 1 warning (0.00 sec)

当or被过滤时可以使用||替换

mysql> select * from fristtb where id= 1 || sex=0x01;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
|  2 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
2 rows in set, 1 warning (0.00 sec)

mysql> select * from fristtb where id= 1 or sex=0x01;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
|  2 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
2 rows in set (0.00 sec)

如果union被过滤时同样可以使用 || 进行拼接

mysql> select * from fristtb where id=1 || (select count(*) from fristtb)>0;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
|  2 | 0x01       | 2001-01-20 00:00:00 |
|  3 | 0x00       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
3 rows in set, 1 warning (0.00 sec)

当where被过滤时，使用 limit 来进行代替

mysql> select * from fristtb where id =1;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  1 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
1 row in set (0.00 sec)

mysql> select * from  fristtb limit  1,1;
+----+------------+---------------------+
| id | sex        | birthday            |
+----+------------+---------------------+
|  2 | 0x01       | 2001-01-20 00:00:00 |
+----+------------+---------------------+
1 row in set (0.00 sec)

可以看到整个结果和where一致

limit有两参数的一个是数据序列号，第二个是你查询的数据量

当limit函数也被过滤时可以使用group by 函数代替

mysql> select id,min(sex),min(birthday) from fristtb group by id having id =1;
+----+--------------------+---------------------+
| id | min(sex)           | min(birthday)       |
+----+--------------------+---------------------+
|  1 | 0x01               | 2001-01-20 00:00:00 |
+----+--------------------+---------------------+
1 row in set (0.00 sec)

group by 是创建一个虚拟的表，虚拟的条件是重fristtb表中取一个id=1的值，min（sex）在表的内部，min是一个list，不是一个单个的值